Matrix Synapse vulnerabilities

CVE-2025-30355 [HIGH] CWE-20 CVE-2025-30355: Synapse is an open source Matrix homeserver implementation. A malicious server can craft events whic Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.

CVE-2018-10657 [HIGH] CWE-20 CVE-2018-10657: Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected wi Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py, as exploited in the wild in April 2018.

CVE-2024-53863 [CRITICAL] CWE-434 CVE-2024-53863: Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynami Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing. This significantly expands the attack s

CVE-2021-41281 [HIGH] CWE-22 CVE-2021-41281: Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Sy Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chose

CVE-2018-16515 [HIGH] CWE-347 CVE-2018-16515: Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.

CVE-2019-5885 [HIGH] CWE-330 CVE-2019-5885: Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, us Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.

CVE-2024-37302 [HIGH] CWE-770 CVE-2024-37302: Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media upl

CVE-2020-26890 [HIGH] CWE-20 CVE-2020-26890: Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON valu Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fix

CVE-2024-52805 [HIGH] CWE-770 CVE-2024-52805: Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported m

CVE-2018-12291 [HIGH] CVE-2018-12291: The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a s The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.

CVE-2019-11842 [HIGH] CWE-338 CVE-2019-11842: An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number gen An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.

CVE-2022-31152 [HIGH] CWE-703 CVE-2022-31152: Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and includi

CVE-2019-18835 [CRITICAL] CWE-345 CVE-2019-18835: Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.

CVE-2022-31052 [MEDIUM] CWE-674 CVE-2022-31052: Synapse is an open source home server implementation for the Matrix chat network. In versions prior Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse p

CVE-2021-21332 [HIGH] CWE-79 CVE-2021-21332: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that S

CVE-2018-12423 [HIGH] CVE-2018-12423: In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels e In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.

CVE-2021-21393 [MEDIUM] CWE-20 CVE-2021-21393: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memo

CVE-2021-21394 [MEDIUM] CWE-20 CVE-2021-21394: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memo

CVE-2024-31208 [MEDIUM] CWE-770 CVE-2024-31208: Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a r Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate excessive data in the database of such instances, resultin

CVE-2020-26257 [MEDIUM] CWE-79 CVE-2020-26257: Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homese Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. Th