CVE-2026-25579: fallo crítico en navidrome
Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.2epss 0.5%
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Productos afectados
navidrome · navidromeCVEs relacionadas — navidrome
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-47062CRITICALMultiple SQL Injections and ORM Leak in navidromeEPSS 4.5%CVE-2025-27112MEDIUMNavidrome has authentication bypass in Subsonic API with non-existent usernameEPSS 1.0%CVE-2023-51442HIGHAuthentication bypass vulnerability in navidrome's subsonic endpointEPSS 0.7%CVE-2025-48948HIGHNavidrome Transcoding Permission Bypass Vulnerability ReportEPSS 0.5%CVE-2025-48949HIGHNavidrome allows SQL Injection via role parameterEPSS 0.5%CVE-2024-32963MEDIUMParameter Tampering vulnerability in NavidromeEPSS 0.4%