Executive brief
Jellyfin is an open-source media server used to host and stream personal video and audio collections. A flaw in the SyncPlay feature, which allows users to watch media together, allows an authorized user to crash the server or block others from joining groups. This can lead to a total service outage or significant performance degradation, requiring a server restart to recover.
Technical details
A denial of service (DoS) vulnerability exists in Jellyfin's SyncPlay group creation endpoint (POST /SyncPlay/New). The root cause is an incorrect sanitizer that fails to limit the size of group names, leading to uncontrolled resource consumption (CWE-400). An authenticated attacker can send large payloads with arbitrary group IDs to exhaust server memory, potentially causing an Out-of-Memory (OOM) crash or locking the endpoint for legitimate users. This vulnerability is reachable over the network but requires 'Low' privileges (an authenticated account). The issue is resolved in version 10.11.7 by implementing strict size limits on the affected API endpoint.
Affected products
- Jellyfin Jellyfin < 10.11.7
Timeline
- 2026-03-31: patched: Version 10.11.7 released
- 2026-04-14: advisory: GitHub Security Advisory published
- 2026-04-14: disclosed