CVE-2026-25579

Name
CVE-2026-25579
Description
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/navidrome/navidrome/releases/tag/v0.60.0
security-advisories@github.com https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:*:*:* navidrome >= None < 0.60.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
navidrome edge-community 0.59.0-r2 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.59.0-r1 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.59.0-r0 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.58.5-r1 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.58.5-r0 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.58.0-r3 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.58.0-r2 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.58.0-r1 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.58.0-r0 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.57.0-r2 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.57.0-r1 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.57.0-r0 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.56.1-r0 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.55.2-r1 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.55.2-r0 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.54.5-r2 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.54.5-r1 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.54.5-r0 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.54.4-r2 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.54.4-r1 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.54.4-r0 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.53.3-r1 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.53.3-r0 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome edge-community 0.47.5-r0 None possibly vulnerable
navidrome 3.23-community 0.58.5-r6 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome 3.23-community 0.58.5-r5 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome 3.23-community 0.58.5-r4 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome 3.23-community 0.58.5-r3 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome 3.23-community 0.58.5-r2 Tom Lebreux <me@tomlebreux.com> possibly vulnerable
navidrome 3.23-community 0.58.5-r1 Tom Lebreux <me@tomlebreux.com> possibly vulnerable