An authenticated user can create SyncPlay groups with arbitrarily long names because the server does not validate the length of the group name field when processing the POST /SyncPlay/New request. The excessive payload size increases the memory footprint of the Jellyfin process, which can grow to the point of exhausting available memory and cause an out‑of‑memory crash, effectively denying service to other clients that attempt to join SyncPlay groups.

The defect affects all Jellyfin installations running a version earlier than 10.11.7. The vendor, Jellyfin, has released version 10.11.7 and newer in which the input validation has been added. All users of the affected software, regardless of deployment size, are vulnerable until they upgrade.

The CVSS score of 6.5 indicates a medium severity. Because the exploit requires an authenticated session, the practical threat level depends on the ease of obtaining a Jellyfin account. No exploit probability is available in the EPSS database and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that, while the mechanism exists, it has not yet been widely abused. Nevertheless, an attacker who can compromise or create an account can repeatedly submit oversized group names to exhaust memory and disrupt service.