GO-2026-4411
NoneCVSS
—
EPSS
—
Published
Feb 5, 2026
CISA due date
—
The record
Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints in github.com/navidrome/navidrome
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/navidrome/navidrome | 0 | 0.60.0 |
Related vulnerabilities
- CVE-2026-25579 Navidrome is an open source web-based music collection server and streamer. Same vulnerability
- GO-2026-4413 Navidrome has XSS via comment from song metadata in github.com/navidrome/navidrome Also affects github.com/navidrome/navidrome
- CVE-2026-25578 Navidrome is an open source web-based music collection server and streamer. Also affects github.com/navidrome/navidrome