Matrix Synapse
40 CVEs affecting Matrix Synapse. Latest disclosed: 2025-03-27. Critical: 2, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18835 | Critical | 9.8 | 2019-11-08 | Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly s… |
CVE-2024-53863 | Critical | 9.1 | 2024-12-03 | Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted reque… |
CVE-2018-16515 | High | 8.8 | 2018-09-18 | Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event… |
CVE-2024-52805 | High | 7.5 | 2024-12-03 | Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory… |
CVE-2024-37302 | High | 7.5 | 2024-12-03 | Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce… |
CVE-2021-41281 | High | 7.5 | 2021-11-23 | Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tr… |
CVE-2020-26890 | High | 7.5 | 2020-11-24 | Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attac… |
CVE-2019-11842 | High | 7.5 | 2019-05-09 | An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers… |
CVE-2019-5885 | High | 7.5 | 2019-03-21 | Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other sec… |
CVE-2018-12423 | High | 7.5 | 2018-06-14 | In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force. |
CVE-2018-12291 | High | 7.5 | 2018-06-13 | The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where… |
CVE-2018-10657 | High | 7.5 | 2018-05-02 | Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to feder… |
CVE-2025-30355 | High | 7.1 | 2025-03-27 | Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 fro… |
CVE-2021-21332 | Medium | 6.9 | 2021-03-26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2024-31208 | Medium | 6.5 | 2024-04-23 | Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch spe… |
CVE-2022-39374 | Medium | 6.5 | 2023-05-26 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the s… |
CVE-2022-41952 | Medium | 6.5 | 2022-11-22 | Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection t… |
CVE-2022-31052 | Medium | 6.5 | 2022-06-28 | Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the av… |
CVE-2020-26257 | Medium | 6.5 | 2020-12-09 | Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-imple… |
CVE-2022-31152 | Medium | 6.4 | 2022-09-02 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorizat… |