CVE-2025-63647 Details
Description
A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server.
A NULL pointer dereference vulnerability has been identified in the Owntone Server application, specifically in the parse_meta function within the src/httpd_daap.c file. This vulnerability is present in versions of Owntone Server through commit 334beb1 in the master branch. The issue allows remote attackers to cause a denial-of-service condition by sending a crafted DAAP request to the server. The vulnerability arises when the server processes a DAAP request with an empty 'meta' parameter, leading to a NULL pointer dereference.
Users can update to the latest version of Owntone Server, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| owntone owntone server | < 28.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 13, 2026 | Reanalysis | [email protected] |
| Jan 30, 2026 | Initial Analysis | [email protected] |
| Jan 21, 2026 | CVE Modified | CISA-ADP |
| Jan 20, 2026 | New CVE Received | [email protected] |