Navidrome, an open‑source music server, allows any authenticated user to supply an oversized size parameter to the /rest/getCoverArt and /share/img token endpoints. The implementation blindly attempts to resize the requested image, which can trigger uncontrolled memory allocation. On systems with limited RAM the Linux OOM killer terminates the Navidrome process, causing a full service outage; on larger systems the request succeeds but results in an extraordinarily large image written to the cache directory, rapidly exhausting disk space. The exploit requires no elevated privileges beyond a valid application credential.

The flaw is present in all Navidrome releases prior to version 0.60.0, regardless of operating system or deployment environment. Any installation that permits authenticated API access is vulnerable. Only the 0.60.0 release and newer contain the patch that limits size handling and removes the uncontrolled allocation path.

The CVSS base score of 9.2 identifies this as a high‑severity vulnerability, yet the EPSS score is less than 1 %, indicating that exploitation is currently rare. The issue is not listed in the CISA KEV catalog. Attackers can achieve denial of service by crafting a single request with an excessively large size parameter, making the attack trivial for users who already possess credentials. Once triggered, the server becomes unavailable until the process is restarted and the disk cache is purged.