Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.
The attacker sends an HTTP request to the /rest/getCoverArt or /share/img/<token> endpoint with an extremely large value for the size parameter. The Navidrome server attempts to generate an image of the requested dimensions, causing uncontrolled RAM consumption growth. If the system has sufficient memory and does not trigger the OOM killer mechanism, Navidrome saves huge image files to the cache directory — multiple such requests allow rapid exhaustion of available disk space. Otherwise, the Linux OOM killer mechanism is triggered, which terminates the Navidrome process, causing complete service unavailability.
An attacker can cause complete shutdown of the Navidrome server (DoS) by exhausting RAM and triggering the OOM killer, and in case of systems with large amounts of RAM — by exhausting disk space by filling the cache directory with enormous image files.
Update Navidrome to version 0.60.0, in which the issue has been fixed. The patch is available in the project's GitHub repository at https://github.com/navidrome/navidrome/releases/tag/v0.60.0
Navidrome in versions prior to 0.60.0. Performing the attack requires having a user account or knowledge of a shared image token.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNavidrome
APPNavidrome< 0.60.0
Related vulnerabilities
SQL Injection i ORM Leak w Navidrome — wyciek danych i brute-force haseł
Navidrome: użycie słabego algorytmu haszowania w integracji z Gravatar
Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in ...
Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 hav...
Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in...