CVE-2026-35034: Jellyfin: Potential Application DoS from excessively large SyncPlay group names
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jellyfinto a version that resolves this vulnerability.Fixed in 10.11.7 - Compensating control
While upgrading, mitigate the SyncPlay group creation endpoint DoS by restricting access to POST /SyncPlay/New to only trusted/authenticated users (e.g., via network/WAF/ACL protections).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35034?
CVE-2026-35034 is classified as a denial of service vulnerability that can potentially disrupt service availability.
How do I fix CVE-2026-35034?
To fix CVE-2026-35034, upgrade Jellyfin to version 10.11.7 or later.
What causes CVE-2026-35034?
CVE-2026-35034 is caused by the ability for an authenticated user to create excessively large SyncPlay group names, leading to potential application denial of service.
Which versions of Jellyfin are affected by CVE-2026-35034?
Versions of Jellyfin prior to 10.11.7 are affected by CVE-2026-35034.
Is CVE-2026-35034 exploitable by unauthenticated users?
No, CVE-2026-35034 can only be exploited by authenticated users.