What’s Vulnerable › Vulnerabilities

CVE-2026-35034: Jellyfin: Potential Application DoS from excessively large SyncPlay group names

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-14 · updated 2026-07-24
• Weakness: CWE-400

Description

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7.

Affected products

• jellyfin: before 10.11.7 — fixed in 10.11.7

How to fix

Upgrade to a fixed version: jellyfin 10.11.7. Check the vendor advisory for mitigations.

References

• https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w

Get alerted when CVE-2026-35034 or the next vulnerability affects your stack