Matrix-org vulnerabilities
85 CVEs and advisories name Matrix-org as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-45056Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
- CVE-2026-45057matrix-sdk-ui: Incomplete edit validation
- CVE-2026-63097Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure
- CVE-2026-63096Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint
- CVE-2026-63095Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint
- CVE-2025-66622matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
- CVE-2025-59160matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
- CVE-2025-59047matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
- CVE-2025-53549Matrix Rust SDK allows SQL injection in the EventCache implementation
- CVE-2025-48937matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
- CVE-2025-27155In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim
- CVE-2025-27146Matrix IRC Bridge allows IRC command injection to own puppeted user
- CVE-2025-23197matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub support
- CVE-2025-24024Mjolnir v1.9.0 accepts commands from any room
- CVE-2024-52594Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib
- CVE-2024-52813matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity
- CVE-2024-52505matrix-appservice-irc allows IRC Command injection in provisioning API
- CVE-2024-50336matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
- CVE-2024-47824Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
- CVE-2024-47080matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver
- CVE-2024-42369A room with itself as a its predecessor will freeze matrix-js-sdk
- CVE-2024-42347URL preview setting for a room is controllable by the homeserver in matrix-react-sdk
- CVE-2024-40648`UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk
- CVE-2024-40640Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac
- CVE-2024-39691Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to
- CVE-2024-34353matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
- CVE-2024-34063Degraded secret zeroization capabilities in vodozemac
- CVE-2024-32000Truncated content of messages can be leaked from matrix-appservice-irc
- CVE-2023-43796Synapse vulnerable to leak of remote user device information
- CVE-2023-45129matrix-synapse vulnerable to denial of service due to malicious server ACL events