Cve-2026-26828 — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-26828/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 24 Mar 2026 12:00:00 +0000OwnTone Server DAAP Request NULL Pointer Dereference Denial-of-Service (CVE-2026-26828)https://feed.craftedsignal.io/briefs/2026-03-owntone-dos/Tue, 24 Mar 2026 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-03-owntone-dos/A NULL pointer dereference vulnerability in the daap_reply_playlists function of owntone-server allows attackers to cause a Denial of Service (DoS) by sending a crafted DAAP request.<p>CVE-2026-26828 describes a NULL pointer dereference vulnerability in the <code>daap_reply_playlists</code> function (src/httpd_daap.c) of owntone-server. The vulnerability resides in commit 3d1652d of the owntone-server project. Attackers can exploit this vulnerability by sending a crafted Digital Audio Access Protocol (DAAP) request to the server, leading to a denial-of-service (DoS) condition. This vulnerability allows unauthenticated remote attackers to disrupt the availability of the owntone-server…</p> mediumadvisorycve-2026-26828denial-of-serviceowntone-server