PT-2026-32959 · Jellyfin · Jellyfin

0Xcyborg · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-35034

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.11.7

Description An authenticated user can cause a denial of service via the 'POST /SyncPlay/New' endpoint. Due to insufficient input validation, it is possible to create groups with names of unlimited size. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients and significantly increase the memory usage of the process, which may lead to an out-of-memory crash.

Recommendations Update to version 10.11.7.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-35034

Affected Products

Jellyfin

References · 6

• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35034 · Security Note
• https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7 · Note
• https://twitter.com/CVEnew/status/2044338892334359013 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044244104314278210 · Twitter Post
• https://twitter.com/user_cyborg/status/2044233184745804090 · Twitter Post