CVE-2026-35034

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35034", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-31T21:06:06.427Z", "datePublished": "2026-04-14T22:31:44.796Z", "dateUpdated": "2026-04-15T17:48:39.733Z"}, "containers": {"cna": {"title": "Jellyfin: Potential Application DoS from excessively large SyncPlay group names", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w"}, {"name": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7"}], "affected": [{"vendor": "jellyfin", "product": "jellyfin", "versions": [{"version": "< 10.11.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T22:31:44.796Z"}, "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7."}], "source": {"advisory": "GHSA-v2jv-54xj-h76w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T17:48:33.580055Z", "id": "CVE-2026-35034", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:48:39.733Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35034", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T17:48:33.580055Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:48:36.837Z"}}], "cna": {"title": "Jellyfin: Potential Application DoS from excessively large SyncPlay group names", "source": {"advisory": "GHSA-v2jv-54xj-h76w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "jellyfin", "product": "jellyfin", "versions": [{"status": "affected", "version": "< 10.11.7"}]}], "references": [{"url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w", "name": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "name": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T22:31:44.796Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35034", "state": "PUBLISHED", "dateUpdated": "2026-04-15T17:48:39.733Z", "dateReserved": "2026-03-31T21:06:06.427Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T22:31:44.796Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jellyfin", "vendor": "jellyfin", "versions": [{"status": "affected", "version": "< 10.11.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*", "matchCriteriaId": "16256CB1-CEA1-4216-B492-D9016420F60D", "versionEndExcluding": "10.11.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7."}, {"lang": "es", "value": "Jellyfin es un servidor de medios de c\u00f3digo abierto autoalojado. Versiones anteriores a la 10.11.7 contienen una vulnerabilidad de denegaci\u00f3n de servicio en el endpoint de creaci\u00f3n de grupos de SyncPlay (POST /SyncPlay/New), donde un usuario autenticado puede crear grupos con nombres de tama\u00f1o ilimitado debido a una validaci\u00f3n de entrada insuficiente. Al enviar grandes cargas \u00fatiles combinadas con IDs de grupo arbitrarios, un atacante puede bloquear el endpoint para otros clientes que intentan unirse a grupos de SyncPlay y aumentar significativamente el uso de memoria del proceso de Jellyfin, lo que podr\u00eda llevar a un fallo por falta de memoria. Este problema ha sido solucionado en la versi\u00f3n 10.11.7."}], "id": "CVE-2026-35034", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35034", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T17:48:33.580055Z", "version": "2.0.3"}}]}, "published": "2026-04-14T23:16:28.977", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.11.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jellyfin", "source": "cna", "vendor": "jellyfin"}, "product": "jellyfin", "vendor": "jellyfin"}], "analysis": {"en": {"generated_at": "2026-04-14T23:20:13.000588+00:00", "value": {"mitigation_remediation": ["Deploy Jellyfin version 10.11.7 or later.", "Implement a maximum size check for the SyncPlay group name field if upgrading is not immediately feasible.", "Consider disabling SyncPlay or limiting group creation rate as a temporary measure."], "summary": {"action": "Patch Now", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The defect affects all Jellyfin installations running a version earlier than 10.11.7. The vendor, Jellyfin, has released version 10.11.7 and newer in which the input validation has been added. All users of the affected software, regardless of deployment size, are vulnerable until they upgrade.", "description_and_impact": "An authenticated user can create SyncPlay groups with arbitrarily long names because the server does not validate the length of the group name field when processing the POST /SyncPlay/New request. The excessive payload size increases the memory footprint of the Jellyfin process, which can grow to the point of exhausting available memory and cause an out\u2011of\u2011memory crash, effectively denying service to other clients that attempt to join SyncPlay groups.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a medium severity. Because the exploit requires an authenticated session, the practical threat level depends on the ease of obtaining a Jellyfin account. No exploit probability is available in the EPSS database and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that, while the mechanism exists, it has not yet been widely abused. Nevertheless, an attacker who can compromise or create an account can repeatedly submit oversized group names to exhaust memory and disrupt service."}}}}, "created": "2026-04-15T13:48:23.615138+00:00", "updated": "2026-04-15T14:31:57.023065+00:00", "vendors": ["jellyfin", "jellyfin$PRODUCT$jellyfin"]}