Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2026-25579

6.5 · MEDIUM

Navidrome is an open source web-based music collection server and streamer.

Published Feb 4, 2026CWE-400EPSS 0.55%

Overview

CVE-2026-25579 is a medium-severity vulnerability. It was published on February 4, 2026 and has a CVSS 3.1 base score of 6.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 6.5, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical description

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

GitHubgithub.com/navidrome/navidrome/releases/tag/v0.60.0GitHubgithub.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3

How CyberStrike helps

Frequently asked questions

What is CVE-2026-25579?

CVE-2026-25579 is a medium-severity vulnerability. It was published on February 4, 2026 and has a CVSS 3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2026-25579?

This vulnerability has a CVSS 3.1 base score of 6.5, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-25579?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-25579?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-25579 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999