# matrix-synapse (PyPI) vulnerabilities

44 known vulnerabilities (6 high, 22 medium, 7 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/matrix-synapse/

## Advisories (44)

### [CVE-2026-45078](https://cve.now/CVE-2026-45078): Synapse CPU starvation (Denial of Service)

- Severity: Medium 6.8
- Published: May 28, 2026
- Affected: fixed in 1.152.1.

### [CVE-2026-45076](https://cve.now/CVE-2026-45076): Synapse pagination denial of service

- Severity: Medium 5.1
- Published: May 28, 2026
- Affected: fixed in 1.152.1.

### [CVE-2025-61672](https://cve.now/CVE-2025-61672): Synapse: Invalid device keys degrade federation functionality

- Severity: Medium 5.3
- Published: Oct 8, 2025
- Affected: fixed in 1.138.3; from 1.139.0rc2, fixed in 1.139.1; fixed in 1.138.3; from 1.139.0rc2, fixed in 1.139.1.

### [CVE-2025-30355](https://cve.now/CVE-2025-30355): Synapse vulnerable to federation denial of service via malformed events

- Severity: High 7.1
- Published: Mar 27, 2025
- Affected: fixed in 1.127.1.

### [CVE-2024-37303](https://cve.now/CVE-2024-37303): Synapse unauthenticated writes to the media repository allow planting of problematic content

- Severity: Medium 5.3
- Published: Dec 3, 2024
- Affected: fixed in 1.106; fixed in 1.106.0.

### [CVE-2024-37302](https://cve.now/CVE-2024-37302): Synapse denial of service through media disk space consumption

- Severity: High 7.5
- Published: Dec 3, 2024
- Affected: fixed in 1.106.0; fixed in 1.106.

### [CVE-2024-52805](https://cve.now/CVE-2024-52805): Synapse allows unsupported content types to lead to memory exhaustion

- Severity: High 8.2
- Published: Dec 3, 2024
- Affected: fixed in 1.120.1.

### [CVE-2024-52815](https://cve.now/CVE-2024-52815): Synapse allows a a malformed invite to break the invitee's \`/sync\`

- Severity: High 8.7
- Published: Dec 3, 2024
- Affected: fixed in 1.120.1.

### [CVE-2024-53867](https://cve.now/CVE-2024-53867): Synapse Matrix has a partial room state leak via Sliding Sync

- Severity: Medium 4.3
- Published: Dec 3, 2024
- Affected: from 1.113.0rc1, fixed in 1.120.1.

### [CVE-2024-53863](https://cve.now/CVE-2024-53863): Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders

- Severity: High 8.2
- Published: Dec 3, 2024
- Affected: fixed in 1.120.1.

### [CVE-2024-31208](https://cve.now/CVE-2024-31208): Synapse's V2 state resolution weakness allows DoS from remote room members

- Severity: Medium 6.5
- Published: Apr 23, 2024
- Affected: fixed in 1.105.1.

### [CVE-2023-43796](https://cve.now/CVE-2023-43796): Synapse vulnerable to leak of remote user device information

- Severity: Medium 5.3
- Published: Oct 31, 2023
- Affected: fixed in 1.95.1.

### [CVE-2023-45129](https://cve.now/CVE-2023-45129): matrix-synapse vulnerable to denial of service due to malicious server ACL events

- Severity: Medium 4.9
- Published: Oct 10, 2023
- Affected: fixed in 1.94.0.

### [CVE-2023-41335](https://cve.now/CVE-2023-41335): Temporary storage of plaintext passwords during password changes in matrix synapse

- Severity: Low 3.7
- Published: Sep 26, 2023
- Affected: from 1.66.0, fixed in 1.93.0.

### [CVE-2023-42453](https://cve.now/CVE-2023-42453): Improper validation of receipts allows forged read receipts in matrix synapse

- Severity: Low 3.1
- Published: Sep 26, 2023
- Affected: from 0.34.0, fixed in 1.93.0; from 1.34.0, fixed in 1.93.0.

### [CVE-2023-32683](https://cve.now/CVE-2023-32683): URL deny list bypass via oEmbed and image URLs when generating previews in Synapse

- Severity: Low 3.5
- Published: Jun 6, 2023
- Affected: fixed in 1.85.0.

### [CVE-2023-32682](https://cve.now/CVE-2023-32682): Improper checks for deactivated users during login in synapse

- Severity: Medium 5.4
- Published: Jun 6, 2023
- Affected: fixed in 1.85.0.

### [CVE-2022-39374](https://cve.now/CVE-2022-39374): Synapse Denial of service due to incorrect application of event authorization rules during state resolution

- Severity: Medium 6.5
- Published: May 26, 2023
- Affected: from 1.62.0, fixed in 1.68.0; from 1.62.0, fixed in 1.68.0rc1.

### [CVE-2022-39335](https://cve.now/CVE-2022-39335): Synapse does not apply enough checks to servers requesting auth events of events in a room

- Severity: Medium 5.0
- Published: May 26, 2023
- Affected: fixed in 1.69.0.

### [CVE-2023-32323](https://cve.now/CVE-2023-32323): Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

- Severity: Medium 5.0
- Published: May 26, 2023
- Affected: fixed in 1.74.0.

### [CVE-2022-41952](https://cve.now/CVE-2022-41952): Uncontrolled Resource Consumption in Matrix Synapse

- Severity: Medium 6.5
- Published: Nov 22, 2022
- Affected: fixed in 1.53.0.

### [CVE-2022-31152](https://cve.now/CVE-2022-31152): Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules

- Severity: Medium 6.4
- Published: Sep 2, 2022
- Affected: fixed in 1.62.0rc1; fixed in 1.62.0.

### [CVE-2022-31052](https://cve.now/CVE-2022-31052): URL previews can crash Synapse media repositories or Synapse monoliths

- Severity: Medium 6.5
- Published: Jun 28, 2022
- Affected: fixed in 1.61.1.

### [CVE-2021-41281](https://cve.now/CVE-2021-41281): Path traversal in Matrix Synapse

- Severity: High 7.5
- Published: Nov 23, 2021
- Affected: fixed in 1.47.1.

### [CVE-2021-39164](https://cve.now/CVE-2021-39164): Improper authorisation of /members discloses room membership to non-members

- Severity: Low 3.1
- Published: Aug 31, 2021
- Affected: fixed in 1.41.1.

### [CVE-2021-39163](https://cve.now/CVE-2021-39163): Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.

- Severity: Low 3.1
- Published: Aug 31, 2021
- Affected: fixed in 1.41.1.

### [CVE-2021-29471](https://cve.now/CVE-2021-29471): Denial of service in Matrix Synapse

- Severity: Low 3.7
- Published: May 11, 2021
- Affected: fixed in 1.33.2.

### [CVE-2021-21392](https://cve.now/CVE-2021-21392): Open redirect via transitional IPv6 addresses on dual-stack networks

- Severity: Medium 6.3
- Published: Apr 12, 2021
- Affected: fixed in 1.28.0rc1; fixed in 1.28.0.

### [CVE-2021-21393](https://cve.now/CVE-2021-21393): Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints

- Severity: Medium 5.3
- Published: Apr 12, 2021
- Affected: fixed in 1.28.0; fixed in 1.28.0.

### [CVE-2021-21394](https://cve.now/CVE-2021-21394): Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints

- Severity: Medium 5.3
- Published: Apr 12, 2021
- Affected: fixed in 1.28.0; fixed in 1.28.0.

### [CVE-2021-21333](https://cve.now/CVE-2021-21333): HTML injection in email and account expiry notifications

- Severity: Medium 6.1
- Published: Mar 26, 2021
- Affected: fixed in 1.27.0.

### [CVE-2021-21332](https://cve.now/CVE-2021-21332): Cross-site scripting (XSS) vulnerability in the password reset endpoint

- Severity: Medium 6.9
- Published: Mar 26, 2021
- Affected: fixed in 1.27.0.

### [CVE-2021-21273](https://cve.now/CVE-2021-21273): Open redirects on some federation and push requests

- Severity: Low 3.1
- Published: Feb 26, 2021
- Affected: fixed in 1.25.0.

### [CVE-2021-21274](https://cve.now/CVE-2021-21274): Denial of service attack via .well-known lookups

- Severity: Medium 4.3
- Published: Feb 26, 2021
- Affected: from 0.99.0, fixed in 1.25.0.

### [CVE-2020-26257](https://cve.now/CVE-2020-26257): Denial of service attack via incorrect parameters to federation APIs

- Severity: Medium 6.5
- Published: Dec 9, 2020
- Affected: fixed in 1.23.1.

### [CVE-2020-26890](https://cve.now/CVE-2020-26890): Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events…

- Severity: Unrated
- Published: Nov 24, 2020
- Affected: fixed in 1.20.0.

### [CVE-2020-26891](https://cve.now/CVE-2020-26891): AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter.

- Severity: Unrated
- Published: Oct 19, 2020
- Affected: fixed in 1.21.0.

### [CVE-2019-18835](https://cve.now/CVE-2019-18835): Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs.

- Severity: Unrated
- Published: Nov 7, 2019
- Affected: fixed in 1.5.0.

### [CVE-2019-11842](https://cve.now/CVE-2019-11842): An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1.

- Severity: Unrated
- Published: May 9, 2019
- Affected: fixed in 0.99.3.1.

### [CVE-2019-5885](https://cve.now/CVE-2019-5885): Matrix Synapse before 0.34.0.1, when the macaroon\_secret\_key authentication parameter is not set, uses a predictable value to derive a…

- Severity: Unrated
- Published: Mar 19, 2019
- Affected: fixed in 0.34.0.1.

### [CVE-2018-16515](https://cve.now/CVE-2018-16515): Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper…

- Severity: Unrated
- Published: Sep 18, 2018
- Affected: from 0.33.3, fixed in 0.33.3.1; fixed in 0.33.2.1; fixed in 0.33.2.1; from 0.33.3, fixed in 0.33.3.1.

### [CVE-2018-12423](https://cve.now/CVE-2018-12423): In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power\_levels event in force.

- Severity: Unrated
- Published: Jun 14, 2018
- Affected: fixed in 0.31.2.

### [CVE-2018-12291](https://cve.now/CVE-2018-12291): The on\_get\_missing\_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get\_missing\_events…

- Severity: Unrated
- Published: Jun 13, 2018
- Affected: fixed in 0.31.1.

### [CVE-2018-10657](https://cve.now/CVE-2018-10657): Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms…

- Severity: Unrated
- Published: May 2, 2018
- Affected: fixed in 0.28.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/matrix-synapse
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.