CVE-2026-35034 Jellyfin: Potential Application DoS from excessively large SyncPlay group names

Medium 6.5 Published 14 Apr 2026 Updated 15 Apr 2026

An authenticated user can cause a denial of service in Jellyfin by creating SyncPlay groups with excessively large names, leading to memory exhaustion.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-35034?

CVE-2026-35034 is a medium-severity denial of service vulnerability in jellyfin, published on 14 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7.

Weakness: CWE-400

Which versions are affected by CVE-2026-35034?

It affects 1 product.

Products include Jellyfin Jellyfin.

How do I fix CVE-2026-35034?

No fix has been published for CVE-2026-35034 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-35034 being exploited?

There is no known exploitation of CVE-2026-35034 in the wild and no public exploit code.

Sources

Also known as GHSA-v2jv-54xj-h76w.