What is the CVSS score of CVE-2026-35034?

CVE-2026-35034 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35034?

Yes, a patch is available for CVE-2026-35034. Update the affected software to the latest version immediately.

Jellyfin CVE-2026-35034

EUVD-2026-22770 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-14 GitHub_M

Denial Of Service Jellyfin

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 23, 2026 - 17:42 nvd

Patch available

Apr 16, 2026 - 05:29 EUVD

10.11.7

Analysis Generated

Apr 15, 2026 - 01:12 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:46 euvd

EUVD-2026-22770

Analysis Generated

Apr 14, 2026 - 22:46 vuln.today

CVE Published

Apr 14, 2026 - 22:31 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7.

AnalysisAI

Denial of service in Jellyfin versions prior to 10.11.7 allows authenticated users to exhaust server resources and crash the SyncPlay media synchronization service via the group creation endpoint (POST /SyncPlay/New) by submitting unbounded payload sizes. An attacker can lock out legitimate clients from accessing SyncPlay functionality and trigger out-of-memory conditions through insufficient input validation on group names and IDs. No public exploit code or active exploitation has been identified.

Technical ContextAI

Jellyfin is an open source media server platform that includes SyncPlay, a feature enabling synchronized media playback across multiple clients. The vulnerability exists in the SyncPlay group creation endpoint which accepts HTTP POST requests without enforcing size limits on group name parameters. The root cause is classified under CWE-400 (Uncontrolled Resource Consumption), a common class where applications fail to restrict the size or number of resources allocated to user-supplied input. The SyncPlay service maintains in-memory data structures for group state management; unbounded group names cause these structures to grow without constraint, exhausting heap memory and potentially triggering garbage collection storms or out-of-memory exceptions that crash the Jellyfin process.

RemediationAI

Vendor-released patch: Jellyfin 10.11.7. Update to version 10.11.7 or later to resolve the vulnerability; the fix includes input validation to enforce size limits on SyncPlay group name parameters and arbitrary group IDs. No workarounds short of disabling the SyncPlay feature are available for versions prior to 10.11.7. Consult the official security advisory at https://github.com/jellyfin/jellyfin/security/advisories/GHSA-v2jv-54xj-h76w and download the patched release from https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7.