CVE-2026-25579: DoS in Navidrome Media Server

The primary impact of CVE-2026-25579 is a Denial of Service. A malicious actor can repeatedly send requests with excessively large size parameters, overwhelming the server's disk space and potentially leading to service unavailability. This could disrupt media streaming for legitimate users and potentially allow an attacker to exhaust system resources, hindering other processes. The blast radius extends to all users relying on the affected Navidrome instance, as the service becomes unresponsive under attack. While direct data exfiltration isn't the primary concern, prolonged DoS could indirectly impact data integrity if critical backups are missed due to service downtime.

1. Reserved2026-02-03
2. Published2026-02-05
3. EPSS updated2026-03-23

The recommended mitigation for CVE-2026-25579 is to immediately upgrade Navidrome to version 0.60.0 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds such as rate limiting requests to the /rest/getCoverArt and /share/img/<token> endpoints using a reverse proxy or WAF. Configure the proxy to reject requests with unusually large size parameters (e.g., exceeding 1MB). Monitor disk space usage closely to detect potential exhaustion. After upgrading, confirm the fix by sending a request with a deliberately oversized size parameter to the affected endpoints and verifying that the server handles it gracefully without crashing or exhausting disk space.