CVE-2026-25579

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25579", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-03T01:02:46.715Z", "datePublished": "2026-02-04T21:58:23.850Z", "dateUpdated": "2026-02-05T14:31:33.790Z"}, "containers": {"cna": {"title": "Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3"}, {"name": "https://github.com/navidrome/navidrome/releases/tag/v0.60.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/navidrome/navidrome/releases/tag/v0.60.0"}], "affected": [{"vendor": "navidrome", "product": "navidrome", "versions": [{"version": "< 0.60.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T21:58:23.850Z"}, "descriptions": [{"lang": "en", "value": "Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0."}], "source": {"advisory": "GHSA-hrr4-3wgr-68x3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T14:24:49.315825Z", "id": "CVE-2026-25579", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:31:33.790Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25579", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T14:24:49.315825Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:24:50.049Z"}}], "cna": {"title": "Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints", "source": {"advisory": "GHSA-hrr4-3wgr-68x3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "navidrome", "product": "navidrome", "versions": [{"status": "affected", "version": "< 0.60.0"}]}], "references": [{"url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3", "name": "https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/navidrome/navidrome/releases/tag/v0.60.0", "name": "https://github.com/navidrome/navidrome/releases/tag/v0.60.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T21:58:23.850Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25579", "state": "PUBLISHED", "dateUpdated": "2026-02-05T14:31:33.790Z", "dateReserved": "2026-02-03T01:02:46.715Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T21:58:23.850Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "navidrome", "vendor": "navidrome", "versions": [{"status": "affected", "version": "< 0.60.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "505C09F4-61BF-49C6-A089-5E2E8577E01B", "versionEndExcluding": "0.60.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0."}, {"lang": "es", "value": "Navidrome es un servidor y streamer de colecci\u00f3n de m\u00fasica basado en web de c\u00f3digo abierto. Antes de la versi\u00f3n 0.60.0, los usuarios autenticados pueden bloquear el servidor de Navidrome al proporcionar un par\u00e1metro de tama\u00f1o excesivamente grande a /rest/getCoverArt o a una URL de imagen compartida (/share/img/). Al procesar dichas solicitudes, el servidor intenta crear una imagen redimensionada extremadamente grande, lo que provoca un crecimiento descontrolado de la memoria. Esto activa el OOM killer de Linux, termina el proceso de Navidrome y resulta en una interrupci\u00f3n completa del servicio. Si el sistema tiene suficiente memoria y sobrevive a la asignaci\u00f3n, Navidrome escribe estas im\u00e1genes redimensionadas extremadamente grandes en su directorio de cach\u00e9, permitiendo que un atacante agote r\u00e1pidamente el espacio en disco del servidor tambi\u00e9n. Este problema ha sido parcheado en la versi\u00f3n 0.60.0."}], "id": "CVE-2026-25579", "lastModified": "2026-06-17T10:24:53.550", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25579", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T14:24:49.315825Z", "version": "2.0.3"}}]}, "published": "2026-02-04T22:16:01.257", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/navidrome/navidrome/releases/tag/v0.60.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}, {"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:08:06.474959+00:00", "value": {"mitigation_remediation": ["Upgrade Navidrome to version 0.60.0 or later to apply the vendor patch that limits size parsing and eliminates uncontrolled allocation.", "If an upgrade cannot be performed immediately, configure your reverse proxy or load balancer to reject requests containing a size parameter above a reasonable threshold or to throttle repeated large requests.", "As a temporary containment measure, clear the Navidrome cache directory and set a disk quota on that directory to prevent further space exhaustion, then monitor for signs of memory pressure."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service (Memory & Disk exhaustion)"}, "threat_synthesis": {"affected_systems": "The flaw is present in all Navidrome releases prior to version 0.60.0, regardless of operating system or deployment environment. Any installation that permits authenticated API access is vulnerable. Only the 0.60.0 release and newer contain the patch that limits size handling and removes the uncontrolled allocation path.", "description_and_impact": "Navidrome, an open\u2011source music server, allows any authenticated user to supply an oversized size parameter to the /rest/getCoverArt and /share/img token endpoints. The implementation blindly attempts to resize the requested image, which can trigger uncontrolled memory allocation. On systems with limited RAM the Linux OOM killer terminates the Navidrome process, causing a full service outage; on larger systems the request succeeds but results in an extraordinarily large image written to the cache directory, rapidly exhausting disk space. The exploit requires no elevated privileges beyond a valid application credential.", "risk_and_exploitability": "The CVSS base score of 9.2 identifies this as a high\u2011severity vulnerability, yet the EPSS score is less than 1\u202f%, indicating that exploitation is currently rare. The issue is not listed in the CISA KEV catalog. Attackers can achieve denial of service by crafting a single request with an excessively large size parameter, making the attack trivial for users who already possess credentials. Once triggered, the server becomes unavailable until the process is restarted and the disk cache is purged."}}}}, "created": "2026-02-05T11:39:21.377773+00:00", "updated": "2026-04-17T23:15:30.801844+00:00", "vendors": ["navidrome", "navidrome$PRODUCT$navidrome"]}