Vulnerability in Element-Hq Synapse
CVE-2025-61672
Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (37.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 37.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000
Affected products
- Element-Hq Synapse — versions < 1.138.3, = 1.139.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr
- github.com/element-hq/synapse/pull/17097
- github.com/element-hq/synapse/commit/26aaaf9e48fff80cf67a20c691c75d670034b3c1
- github.com/element-hq/synapse/commit/7069636c2d6d1ef2022287addf3ed8b919ef2740
- github.com/element-hq/synapse/releases/tag/v1.138.3
- github.com/element-hq/synapse/releases/tag/v1.139.1
Frequently asked questions
- What is CVE-2025-61672?
- CVE-2025-61672 is a vulnerability in Element-Hq Synapse, classified under CWE-1287. Published 2025-10-08.
- Is CVE-2025-61672 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.