Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

matrix-synapse

44 known vulnerabilities (6 high, 22 medium, 7 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
44 · 6 high, 22 medium, 7 low
Registry
PyPI

Advisories 44

  • CVE-2026-45078Medium 6.8

    Synapse CPU starvation (Denial of Service)

    Affected: fixed in 1.152.1.

  • CVE-2026-45076Medium 5.1

    Synapse pagination denial of service

    Affected: fixed in 1.152.1.

  • CVE-2025-61672Medium 5.3

    Synapse: Invalid device keys degrade federation functionality

    Affected: fixed in 1.138.3; from 1.139.0rc2, fixed in 1.139.1; fixed in 1.138.3; from 1.139.0rc2, fixed in 1.139.1.

  • Synapse vulnerable to federation denial of service via malformed events

    Affected: fixed in 1.127.1.

  • CVE-2024-37303Medium 5.3

    Synapse unauthenticated writes to the media repository allow planting of problematic content

    Affected: fixed in 1.106; fixed in 1.106.0.

  • Synapse denial of service through media disk space consumption

    Affected: fixed in 1.106.0; fixed in 1.106.

  • Synapse allows unsupported content types to lead to memory exhaustion

    Affected: fixed in 1.120.1.

  • Synapse allows a a malformed invite to break the invitee's `/sync`

    Affected: fixed in 1.120.1.

  • CVE-2024-53867Medium 4.3

    Synapse Matrix has a partial room state leak via Sliding Sync

    Affected: from 1.113.0rc1, fixed in 1.120.1.

  • Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders

    Affected: fixed in 1.120.1.

  • CVE-2024-31208Medium 6.5

    Synapse's V2 state resolution weakness allows DoS from remote room members

    Affected: fixed in 1.105.1.

  • CVE-2023-43796Medium 5.3

    Synapse vulnerable to leak of remote user device information

    Affected: fixed in 1.95.1.

  • CVE-2023-45129Medium 4.9

    matrix-synapse vulnerable to denial of service due to malicious server ACL events

    Affected: fixed in 1.94.0.

  • Temporary storage of plaintext passwords during password changes in matrix synapse

    Affected: from 1.66.0, fixed in 1.93.0.

  • Improper validation of receipts allows forged read receipts in matrix synapse

    Affected: from 0.34.0, fixed in 1.93.0; from 1.34.0, fixed in 1.93.0.

Show all 44 advisoriesShow fewer advisories

  • URL deny list bypass via oEmbed and image URLs when generating previews in Synapse

    Affected: fixed in 1.85.0.

  • CVE-2023-32682Medium 5.4

    Improper checks for deactivated users during login in synapse

    Affected: fixed in 1.85.0.

  • CVE-2022-39374Medium 6.5

    Synapse Denial of service due to incorrect application of event authorization rules during state resolution

    Affected: from 1.62.0, fixed in 1.68.0; from 1.62.0, fixed in 1.68.0rc1.

  • CVE-2022-39335Medium 5.0

    Synapse does not apply enough checks to servers requesting auth events of events in a room

    Affected: fixed in 1.69.0.

  • CVE-2023-32323Medium 5.0

    Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

    Affected: fixed in 1.74.0.

  • CVE-2022-41952Medium 6.5

    Uncontrolled Resource Consumption in Matrix Synapse

    Affected: fixed in 1.53.0.

  • CVE-2022-31152Medium 6.4

    Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules

    Affected: fixed in 1.62.0rc1; fixed in 1.62.0.

  • CVE-2022-31052Medium 6.5

    URL previews can crash Synapse media repositories or Synapse monoliths

    Affected: fixed in 1.61.1.

  • Path traversal in Matrix Synapse

    Affected: fixed in 1.47.1.

  • Improper authorisation of /members discloses room membership to non-members

    Affected: fixed in 1.41.1.

  • Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.

    Affected: fixed in 1.41.1.

  • Denial of service in Matrix Synapse

    Affected: fixed in 1.33.2.

  • CVE-2021-21392Medium 6.3

    Open redirect via transitional IPv6 addresses on dual-stack networks

    Affected: fixed in 1.28.0rc1; fixed in 1.28.0.

  • CVE-2021-21393Medium 5.3

    Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints

    Affected: fixed in 1.28.0; fixed in 1.28.0.

  • CVE-2021-21394Medium 5.3

    Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints

    Affected: fixed in 1.28.0; fixed in 1.28.0.

  • CVE-2021-21333Medium 6.1

    HTML injection in email and account expiry notifications

    Affected: fixed in 1.27.0.

  • CVE-2021-21332Medium 6.9

    Cross-site scripting (XSS) vulnerability in the password reset endpoint

    Affected: fixed in 1.27.0.

  • Open redirects on some federation and push requests

    Affected: fixed in 1.25.0.

  • CVE-2021-21274Medium 4.3

    Denial of service attack via .well-known lookups

    Affected: from 0.99.0, fixed in 1.25.0.

  • CVE-2020-26257Medium 6.5

    Denial of service attack via incorrect parameters to federation APIs

    Affected: fixed in 1.23.1.

  • Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events…

    Affected: fixed in 1.20.0.

  • AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter.

    Affected: fixed in 1.21.0.

  • Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs.

    Affected: fixed in 1.5.0.

  • An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1.

    Affected: fixed in 0.99.3.1.

  • Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a…

    Affected: fixed in 0.34.0.1.

  • Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper…

    Affected: from 0.33.3, fixed in 0.33.3.1; fixed in 0.33.2.1; fixed in 0.33.2.1; from 0.33.3, fixed in 0.33.3.1.

  • In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.

    Affected: fixed in 0.31.2.

  • The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events…

    Affected: fixed in 0.31.1.

  • Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms…

    Affected: fixed in 0.28.1.