Read the docs
TI-2026-20686 Aliases CVE-2026-25579GHSA-hrr4-3wgr-68x3

Uncontrolled resource consumption in navidrome

Priority MEDIUM 46CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00505 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed navidrome (navidrome): 0.60.0github.com/navidrome/navidrome (Go): 0.60.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
navidromenavidromebefore 0.60.00.60.0Patch availableCNA
—github.com/navidrome/navidrome (Go)before 0.60.00.60.0Patch availableGHSA-hrr4-3wgr-68x3
  • navidrome Vendornavidrome Affected before 0.60.0 Fixed in 0.60.0 Patch available CNA
  • github.com/navidrome/navidrome (Go) Vendor— Affected before 0.60.0 Fixed in 0.60.0 Patch available GHSA-hrr4-3wgr-68x3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:*:*:*before 0.60.0Vulnerablenavidrome
  • cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:*:*:* Versions before 0.60.0 Vulnerable ·navidrome

Remediation

  • Fix · CNA navidrome (navidrome) Fixed in 0.60.0
  • Fix · GHSA-hrr4-3wgr-68x3 github.com/navidrome/navidrome (Go) Fixed in 0.60.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25579
  2. 2026-10-03 Alias added: GHSA-hrr4-3wgr-68x3

References

Exploit 1

Advisory 1

Other 2

  • TI-2025-31087 Navidrome allows SQL Injection via role parameter CVSS 4.0HIGH 8.9
  • TI-2024-31444 Multiple SQL Injections and ORM Leak in navidrome CVSS 4.0CRITICAL 9.4
  • TI-2025-19982 Navidrome has authentication bypass in Subsonic API with non-existent username CVSS 4.0MEDIUM 6.9
  • TI-2025-31086 Navidrome Transcoding Permission Bypass Vulnerability Report CVSS 4.0HIGH 7.4
  • TI-2024-21830 Parameter Tampering vulnerability in Navidrome CVSS 3.1MEDIUM 4.2
  • TI-2024-27560 Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows… CVSS 3.1CRITICAL 9.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences