Jellyfin CVE-2026-35034

The CVSS 6.5 score reflects a medium-severity but high-impact vulnerability: the vector shows unauthenticated access is NOT required (PR:L indicates authentication is mandatory), with low attack complexity, network reachability, and high availability impact (A:H) but no confidentiality or integrity breach. The authentication requirement significantly limits exposure compared to unauthenticated DoS vulnerabilities. However, the real-world risk is substantial for multi-user Jellyfin deployments where legitimate users can be authenticated - a single compromised user account or insider threat can degrade service for all SyncPlay users. The CVSS score appropriately captures the DoS severity; this is not an inflated rating. The fix is available in a released version (10.11.7), which reduces urgency for already-patched instances but creates risk for lagging deployments.

A malicious authenticated user (or an attacker who has obtained valid credentials through phishing or password compromise) crafts an HTTP POST request to the /SyncPlay/New endpoint with a group name parameter containing megabytes of arbitrary data. The server allocates memory to store this oversized group without validation, and by submitting multiple such requests with varying group IDs, the attacker causes the Jellyfin process memory usage to spike uncontrollably. Within seconds to minutes, the process exhausts available heap memory and crashes, rendering SyncPlay unavailable for all legitimate users and potentially affecting other Jellyfin services.