CVE-2026-35034: 
NixOS vulnerability analysis and mitigation

CVE-2026-35034 is a denial-of-service vulnerability in Jellyfin, an open-source self-hosted media server, affecting all versions prior to 10.11.7. The flaw resides in the SyncPlay group creation endpoint (POST /SyncPlay/New), where insufficient input validation allows authenticated users to create groups with arbitrarily large names, exhausting server memory and potentially crashing the service. It was published on April 14, 2026, and patched in version 10.11.7. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption): Jellyfin's SyncPlay endpoint lacks a maximum length constraint on the group name field, allowing unbounded memory allocation per request. An authenticated attacker can repeatedly send POST /SyncPlay/New requests with oversized name payloads and arbitrary group IDs, causing the server to allocate increasing amounts of memory for each group object. This combination can lock out the endpoint for legitimate clients attempting to join SyncPlay groups and drive the Jellyfin process into an out-of-memory (OOM) condition. The fix in version 10.11.7 introduces improved sanitization that enforces a maximum name size on the affected API endpoint (GitHub Advisory).

Successful exploitation results in a high availability impact: the SyncPlay feature becomes unavailable to legitimate users as the endpoint is locked out, and the Jellyfin server process may crash entirely due to out-of-memory conditions. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service issue. Self-hosted Jellyfin instances with SyncPlay enabled and any authenticated user (including low-privilege accounts) are at risk of complete service disruption (GitHub Advisory, Jellyfin Release).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report (Feedly). The vulnerability requires low-privilege authenticated access, meaning any registered user on a Jellyfin instance can trigger it without additional permissions. The EPSS score is approximately 0.039%, indicating a low probability of exploitation in the near term. CVE-2026-35034 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by researcher 0xcyborg (GitHub Advisory).

1. Authenticate: Obtain valid credentials for any user account on the target Jellyfin instance (even a low-privilege account suffices).
2. Identify the endpoint: Confirm the target is running Jellyfin prior to version 10.11.7 and that SyncPlay is enabled (default in most deployments).
3. Craft oversized payload: Construct an HTTP POST request to /SyncPlay/New with an excessively large GroupName field (e.g., a string of several megabytes) and an arbitrary GroupId value.
4. Send repeated requests: Automate sending multiple such requests in rapid succession to continuously allocate memory on the server and prevent the endpoint from serving legitimate clients.
5. Achieve DoS: The Jellyfin process memory usage climbs with each request; other clients attempting to join or create SyncPlay groups are locked out, and the server may eventually crash with an OOM error (GitHub Advisory).

• Network: High volume of POST /SyncPlay/New requests from a single authenticated user or IP address; requests with unusually large HTTP body sizes targeting the SyncPlay endpoint.
• Logs: Jellyfin application logs showing repeated SyncPlay group creation events with abnormally large group name strings; error entries related to memory allocation failures or OOM conditions.
• Process: Rapid, sustained growth in Jellyfin process memory consumption (observable via system monitoring tools such as top, htop, or Task Manager); potential process crash/restart events logged by the OS or service manager (e.g., systemd journal entries for Jellyfin service restarts).

The primary remediation is to upgrade Jellyfin to version 10.11.7 or later, which enforces a maximum size limit on SyncPlay group names via improved API input sanitization (Jellyfin Release, GitHub Advisory). No official workaround is provided by the vendor for users who cannot immediately upgrade. As interim mitigations, administrators should consider implementing network-level access controls to restrict authenticated access to trusted users only, disabling SyncPlay if it is not required, and monitoring Jellyfin process memory usage for unusual spikes that may indicate exploitation attempts.

The Jellyfin project released version 10.11.7 with a warning that it contains "several extremely important security fixes" and advised all users on prior versions to upgrade immediately (Jellyfin Release). The release received positive community engagement on GitHub (231 reactions). The vulnerability was noted in automated CVE tracking feeds and vulnerability databases shortly after disclosure, but no significant independent researcher commentary or media coverage has been identified beyond routine aggregation.