9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25579

CVE-2026-25579: Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25579

CVE-2026-25579:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/navidrome/navidrome	go	< 0.60.0	0.60.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of input validation for the size parameter used in image resizing operations, leading to a denial of service. The analysis of the security advisory and the associated patch confirms this. The patch was identified by comparing the git tags for the last vulnerable version (v0.59.0) and the first patched version (v0.60.0). The key commit, 77367548f6a255cd5f182b09633e5208b49a5a72, modifies the core/artwork/reader_resized.go file.

The root cause is in the artwork.resizeImage function, which, before the patch, would attempt to resize an image to any given size. The fix involves adding a check to clamp the requested size to the original image's dimensions, thus preventing excessive memory allocation from upscaling attempts.

Two main HTTP handlers act as entry points for this vulnerability:

SubsonicAPI.getCoverArt, which handles the /rest/getCoverArt endpoint for authenticated users.
PublicAPI.getSharedImage, which handles the /share/img/<token> endpoint for shared images.

Both functions extract the size parameter from the HTTP request and pass it down to the artwork processing service without validation. An attacker can exploit this by sending a request to either endpoint with an extremely large value for the size parameter, triggering the vulnerability in artwork.resizeImage, causing the server to run out of memory and crash, or fill up the disk with oversized cached images.

Vulnerable functions

artwork.resizeImage

core/artwork/reader_resized.go

This function is responsible for resizing images. Prior to the patch, it directly used the 'size' parameter provided by the user without any validation. An attacker could supply an excessively large integer for 'size', causing the function to attempt to allocate a massive amount of memory for the new image, leading to a denial of service by exhausting memory resources. The patch mitigates this by clamping the requested 'size' to the image's original dimensions, preventing upscaling and excessive memory allocation.

SubsonicAPI.getCoverArt

ui/subsonic/subsonic.go

This function serves as an entry point for the vulnerability for authenticated users. It handles requests to the `/rest/getCoverArt` endpoint, retrieves the `size` parameter from the request, and passes it to the `api.artwork.GetOrPlaceholder` function without performing any size validation. This allows an unvalidated, potentially huge, size value to reach the vulnerable `artwork.resizeImage` function.

PublicAPI.getSharedImage

ui/public/router.go

This function serves as a second entry point for the vulnerability, accessible via a valid sharing token. It handles requests to the `/share/img/<token>` endpoint, retrieves the `size` parameter from the request, and passes it to the `api.artwork.Get` function without any size validation. This provides another path for an attacker to send a malicious size value to the vulnerable `artwork.resizeImage` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.