Owntone-server contains a NULL pointer dereference bug in its safe_atou64 function. Attackers can exploit this flaw by sending crafted HTTP requests to the server, causing the process to crash and resulting in a denial of service. The vulnerability is a classic null pointer dereference (CWE‑476) that affects the availability of the media streaming service but does not provide code execution or privilege escalation. The impact is confined to service disruption for users depending on the server.

The issue is confined to the HTTP interface of servers running owntone‑server that have not been updated to the fixed commit 41e3733. There is no publicly disclosed version range, but any instance prior to the patch is potentially vulnerable. The problem was identified in the source file src/misc.c and the fix is present in the commit referenced by the advisory. The advisory and patches are available in the owntone GitHub repository.

The CVSS base score of 7.5 indicates a high severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalogue. Exploitation requires only unauthenticated HTTP access to the vulnerable endpoint; no special privileges or credentials are necessary. An attacker can repeatedly send malicious requests to bring down the service. Although no public exploits are known, the nature of the flaw makes it a high risk to availability for any user running an unpatched owntone-server.