CVE-2026-35034

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35034
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35034.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35034
Aliases
  • GHSA-v2jv-54xj-h76w
Published
2026-04-14T22:31:44Z
Modified
2026-08-12T03:51:44Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Jellyfin: Potential Application DoS from excessively large SyncPlay group names
Details

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35034.json"
}
References

Affected packages

Git / github.com/jellyfin/jellyfin

Affected ranges

Type
GIT
Repo
https://github.com/jellyfin/jellyfin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b2aa80ce5c1af2a4478d13b50c0961e11a6f5e6b
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.11.7"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/jellyfin/jellyfin-web
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
29a6a0fd50862615f8e88fefbeee35957a5ed051
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.11.7"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v10.*
v10.0.0
v10.0.1
v10.0.2
v10.1.0
v10.11.0
v10.11.0-rc1
v10.11.0-rc2
v10.11.0-rc3
v10.11.0-rc4
v10.11.0-rc5
v10.11.0-rc6
v10.11.0-rc7
v10.11.0-rc8
v10.11.0-rc9
v10.11.1
v10.11.2
v10.11.3
v10.11.4
v10.11.5
v10.11.6
v10.3.0-rc1
v10.4.0
v10.5.0
v10.6.0
v10.8.0-alpha1
v10.8.0-alpha2
v10.8.0-alpha3
v10.8.0-alpha4
v10.8.0-alpha5
v3.*
v3.5.2-3
v3.5.2-4
v3.5.2-5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35034.json"