152 matches found
CVE-2026-25579 Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL /share/img/. When processing such requests, the...
CVE-2026-25579
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL /share/img/. When processing such requests, the...
CVE-2026-25579 Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL /share/img/. When processing such requests, the...
Memory Allocation with Excessive Size Value
Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the size parameter in the /rest/getCoverArt and /share/img/ endpoints. An attacker can cause excessive memory allocation and disk exhaustion by supplying an extremely large value, leading ...
GHSA-HRR4-3WGR-68X3 Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
Summary Authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL /share/img/. When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth...
Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
Summary Authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL /share/img/. When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth...
PT-2026-6325
Name of the Vulnerable Software and Affected Versions Navidrome versions prior to 0.60.0 Description Navidrome is a web-based music collection server and streamer. A cross-site scripting issue exists in the frontend that allows a malicious attacker to inject code through the comment metadata of a...
Navidrome 安全漏洞
Navidrome is an open-source web-based music collection server and streaming service developed by Navidrome. It allows users to listen to their music collections from any browser or mobile device. Versions of Navidrome prior to 0.60.0 contained security vulnerabilities; these vulnerabilities stemm...
Navidrome 安全漏洞
Navidrome is an open-source web-based music collection server and streaming service developed by Navidrome. It allows users to listen to their music collections from any browser or mobile device. Versions of Navidrome prior to 0.60.0 contained a security vulnerability that occurred when attemptin...
PT-2026-6326
Name of the Vulnerable Software and Affected Versions Navidrome versions prior to 0.60.0 Description Navidrome is a web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can cause a denial of service by providing a large size parameter to the /rest/getCoverA...
CVE-2026-25579
creationtimestamp| type| source ---|---|--- 2026-02-03 21:35:13+00:00| published-proof-of-concept| https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3...
CVE-2026-25578
creationtimestamp| type| source ---|---|--- 2026-02-03 21:34:58+00:00| published-proof-of-concept| https://github.com/navidrome/navidrome/security/advisories/GHSA-rh3r-8pxm-hg4w...
CVE-2024-41259
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information...
EUVD-2024-1415
Malicious code in bioql PyPI...
EUVD-2022-0665
Malicious code in bioql PyPI...
EUVD-2023-3317
Malicious code in bioql PyPI...
EUVD-2025-16522
Malicious code in bioql PyPI...
EUVD-2025-16433
Malicious code in bioql PyPI...
EUVD-2024-3622
Malicious code in bioql PyPI...
FreeBSD : navidrome -- transcoding permission bypass vulnerability (95480188-6ebc-11f0-8a78-bf201f293bce)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 95480188-6ebc-11f0-8a78-bf201f293bce advisory. Deluan Quinto reports: A permission verification flaw in Navidrome allows any authenticated regular use...