Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
@jellyfin @github This vulnerability has been assigned CVE-2026-35034 References: https://www.cve.org/CVERecord?id=CVE-2026-35034 https://gist.github.com/0xcyborg/8cc77adb674dfc0c42f2c6061778d8de
Post summary
The tweet simply announces the assignment of CVE-2026-35034 and provides links, including a GitHub gist that likely contains PoC code, but otherwise lacks specific technical or exploit details.
CVE-2026-35034 Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST… https://www.cve.org/CVERecord?id=CVE-2026-35034
Post summary
The post announces a DoS flaw in Jellyfin’s SyncPlay endpoint for versions prior to 10.11.7, but provides no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-35034 Denial of Service in Jellyfin SyncPlay Group Creation Prior to 10.11.7 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35034
Post summary
The post announces CVE‑2026‑35034, a DoS flaw in Jellyfin’s SyncPlay before version 10.11.7, without providing PoC, exploitation details, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jellyfin | jellyfin | - | - | - |