{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35034", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-31T21:06:06.427Z", "datePublished": "2026-04-14T22:31:44.796Z", "dateUpdated": "2026-04-15T17:48:39.733Z"}, "containers": {"cna": {"title": "Jellyfin: Potential Application DoS from excessively large SyncPlay group names", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w"}, {"name": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7"}], "affected": [{"vendor": "jellyfin", "product": "jellyfin", "versions": [{"version": "< 10.11.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T22:31:44.796Z"}, "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7."}], "source": {"advisory": "GHSA-v2jv-54xj-h76w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T17:48:33.580055Z", "id": "CVE-2026-35034", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:48:39.733Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7."}], "id": "CVE-2026-35034", "lastModified": "2026-04-14T23:16:28.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-14T23:16:28.977", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.11.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jellyfin", "source": "cna", "vendor": "jellyfin"}, "product": "jellyfin", "vendor": "jellyfin"}], "analysis": {"en": {"generated_at": "2026-04-14T23:20:13.000588+00:00", "value": {"mitigation_remediation": ["Deploy Jellyfin version 10.11.7 or later.", "Implement a maximum size check for the SyncPlay group name field if upgrading is not immediately feasible.", "Consider disabling SyncPlay or limiting group creation rate as a temporary measure."], "summary": {"action": "Patch Now", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The defect affects all Jellyfin installations running a version earlier than 10.11.7. The vendor, Jellyfin, has released version 10.11.7 and newer in which the input validation has been added. All users of the affected software, regardless of deployment size, are vulnerable until they upgrade.", "description_and_impact": "An authenticated user can create SyncPlay groups with arbitrarily long names because the server does not validate the length of the group name field when processing the POST /SyncPlay/New request. The excessive payload size increases the memory footprint of the Jellyfin process, which can grow to the point of exhausting available memory and cause an out\u2011of\u2011memory crash, effectively denying service to other clients that attempt to join SyncPlay groups.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a medium severity. Because the exploit requires an authenticated session, the practical threat level depends on the ease of obtaining a Jellyfin account. No exploit probability is available in the EPSS database and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that, while the mechanism exists, it has not yet been widely abused. Nevertheless, an attacker who can compromise or create an account can repeatedly submit oversized group names to exhaust memory and disrupt service."}}}}, "created": "2026-04-15T13:48:23.615138+00:00", "updated": "2026-04-15T14:31:57.023065+00:00", "vendors": ["jellyfin", "jellyfin$PRODUCT$jellyfin"]}