Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
45 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact In federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. Patches Update to Synapse 1.152.1 or later. Workarounds There are no known workarounds for this issue. Identifiers - ELEMENTSEC-2025-1636 For more information If you have any questions or comments about this advisory, please email us at security at element.io.
Recommended action: Upgrade to 1.152.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Local authenticated users can cause Synapse to starve other requests of CPU and lead to other requests failing, causing other users to be denied service. Homeservers that trust all their local users are not at risk. Patches Update to Synapse 1.152.1 or later. Workarounds If Synapse is deployed behind a reverse proxy, the reverse proxy could be configured to limit the rate of user requests, preventing or increasing the difficulty of the attack. Identifiers - ELEMENTSEC-2026-1706 For more information If you have any questions or comments about this advisory, please email us at security at element.io.
Recommended action: Upgrade to 1.152.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. Patches Patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2. Workarounds The vulnerability can only be exploited by users registered on the victim homeserver.
Recommended action: Upgrade to 1.139.1 or 1.138.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A malicious server can craft events with a depth outside the integer range allowed by Canonical JSON. When such an event is received by Synapse version up to 1.127.0, it prevents it from federating with other servers. The vulnerability has been exploited in the wild. Patches Fixed in Synapse v1.127.1. Workarounds Closed federation environments of trusted servers or non-federating installations are not affected. For more information If you have any questions or comments about this advisory, please email us at security at element.io.
Recommended action: Upgrade to 1.127.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. Patches Synapse version 1.120.1 fixes the problem. Workarounds Disable Sliding Sync. References https://github.com/matrix-org/matrix-spec-proposals/pull/4186 https://github.com/element-hq/synapse/blob/d80cd57c54427687afcb48740d99219c88a0fff1/synapse/config/experimental.py#L341-L344 For more information If you have any questions or comments about this advisory, please email us at security at element.io.
Recommended action: Upgrade to 1.120.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing. This significantly expands the attack surface in a historically vulnerable area, presenting a risk that far outweighs the benefit, particularly since these formats are rarely used on the open web or within the Matrix ecosystem. For a list of image formats, as well as decoding libraries and helper programs used, see the Pillow documentation. Patches Synapse 1.120.1 addresses the issue by restricting thumbnail generation to images in the following widely used formats: PNG, JPEG, GIF, and WebP. Workarounds - Ensure any image codecs and helper programs, such as Ghostscript, are patched against security vulnerabilities. - Uninstall unused image decoder libraries and helper programs, such as Ghostscript, from the system…
Recommended action: Upgrade to 1.120.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Patches Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users. Workarounds Server administrators can disable federation from untrusted servers. For more information If you have any questions or comments about this advisory, please email us at security at element.io.
Recommended action: Upgrade to 1.120.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Patches Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type. Workarounds Limiting request sizes or blocking the multipart/form-data content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low maxuploadsize in Synapse. References - https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518 - https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609 For more information If you have any questions or comments about this advisory, please email us at security at element.io.
Recommended action: Upgrade to 1.120.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Patches Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Workarounds Though extremely limited, server operators can use more strict rate limits based on IP address. References https://github.com/matrix-org/matrix-spec-proposals/pull/3916 For more information If you have any questions or comments about this advisory, please email us at security at element.io.
Recommended action: Upgrade to 1.106 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Patches Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached. Workarounds Synapse deployments can currently decrease the maximum file size allowed, as well as increase request rate limits. However, this does not as effectively address the issue as a dedicated rate limit on remote media downloads. Server operators may also wish to consider…
Recommended action: Upgrade to 1.106 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in how the auth chain cover index is calculated. This can induce high CPU consumption and accumulate excessive data in the database of such instances, resulting in a denial of service. Servers in private federations, or those that do not federate, are not affected. Patches Server administrators should upgrade to 1.105.1 or later. Workarounds One can: - ban the malicious users or ACL block servers from the rooms; and/or - leave the room and purge the room using the admin API For more information If you have any questions or comments about this advisory, please email us at security AT element.io.
Recommended action: Upgrade to 1.105.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. Patches System administrators are encouraged to upgrade to Synapse 1.95.1 as soon as possible. Workarounds The federationdomainwhitelist can be used to limit federation traffic with a homeserver.
Recommended action: Upgrade to 1.95.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected. Patches Server administrators are advised to upgrade to Synapse 1.94.0 or later. Workarounds Rooms with malicious server ACL events can be purged and blocked using the admin API.
Recommended action: Upgrade to 1.94.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. Patches https://github.com/matrix-org/synapse/pull/16327 Workarounds There is no workaround.
Recommended action: Upgrade to 1.93.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration. These temporarily stored passwords are automatically erased after a 48-hour window. Patches https://github.com/matrix-org/synapse/pull/16272 References This bug was due to a regression in https://github.com/matrix-org/synapse/pull/13188.
Recommended action: Upgrade to 1.93.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A discovered oEmbed or image URL can bypass the urlpreviewurlblacklist setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the urlpreviewiprangeblacklist setting (by default this only allows public IPs) and by the limited information returned to the client: For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. For discovered image URLs, any non-image response is discarded. Systems which have URL preview disabled (via the urlpreviewenabled setting) or have not configured a urlpreviewurlblacklist are not affected. Because of the uncommon configuration required, the limited information a malicious user, and the amount of guesses/time the attack would need; the severity is rated as low. Patches The issue is fixed by #15601. Workarounds The default configuration of the urlpreviewiprangeblacklist should protect against requests being…
Recommended action: Upgrade to 1.85.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: JSON Web Tokens are enabled for login via the jwtconfig.enabled configuration setting The local password database is enabled via the passwordconfig.enabled and passwordconfig.localdbenabled configuration settings and a user's password is updated via an admin API after a user is deactivated. Note that the local password database is enabled by default, but it is uncommon to set a user's password after they've been deactivated. Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected. Patches If using JSON Web Token logins: #15624 For other users: #15634 Workarounds If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This list of users can be queried from PostgreSQL:
Recommended action: Upgrade to 1.85.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. Details The Matrix protocol allows homeservers to provide an inviteroomstate field on a room invite containing a summary of room state. In versions of Synapse up to and including v1.73.0, Synapse did not limit the size of inviteroomstate, meaning that it was possible to create an arbitrarily large invite event. An attacker with an account on a vulnerable Synapse homeserver X could exploit this by having X create an over-sized invite event in a room with a user from another homeserver Y. Once acknowledged by the invitee's homeserver, the invite event would be sent in a batch of events to Y. If the malicious invite is so large that the entire batch is rejected as too large, X's outgoing traffic to Y would become "stuck", meaning that messages and state events…
Recommended action: Upgrade to 1.74.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. Synapse homeservers are affected by this issue if and only if they are joined to rooms which members of untrusted homeservers are joined or invited to. - Synapse homeservers in rooms available over public federation are affected. - Synapse homeservers with federation disabled are not affected. - Synapse homeservers in a closed federation containing only trusted servers are not affected. - Synapse homeservers which are only joined to rooms with federation disabled[^1] are not affected. Patches Administrators of homeservers with federation enabled are advised to upgrade to 1.68.0 or higher. Workarounds Federation can be disabled by…
Recommended action: Upgrade to 1.68.0rc1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorisation events of events in a room. This is necessary so that a homeserver receiving some events can validate that those events are legitimate and permitted in their room. However, in versions of Synapse up to and including 1.68.0, a Synapse homeserver answering a query for authorisation events does not sufficiently check that the requesting server should be able to access them. Authorisation events include power level events (the list of user IDs and their power levels at the time) and relevant membership events (including the display name of the sender of that event), as well as events like m.room.create, m.room.thirdpartyinvite and m.room.joinrules. Non-authorisation events are unaffected, so it isn't possible to e.g. extract message contents this way. This issue is only exploitable when a malicious actor…
Recommended action: Upgrade to 1.69.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including v1.61, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Patches Administrators of homeservers with federation enabled are advised to upgrade to v1.62.0 or higher. Workarounds Federation can be disabled by setting federationdomainwhitelist to an empty list ([]). References https://github.com/matrix-org/synapse/pull/13087 https://github.com/matrix-org/synapse/pull/13088 For more information If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Recommended action: Upgrade to 1.62.0rc1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether. It is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for. Remote users are not able to exploit this directly, because the URL preview endpoint is authenticated. Am I affected? deployments with urlpreviewenabled: false set in configuration are not affected. deployments with urlpreviewenabled: true set in configuration are affected. deployments with no configuration value set for urlpreviewenabled are not affected, because the default is false. Patches Administrators of homeservers with URL previews enabled are advised to upgrade to v1.61.1 or higher. Workarounds URL previews can…
Recommended action: Upgrade to 1.61.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers.
Recommended action: Upgrade to 1.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.
Recommended action: Upgrade to 0.99.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2<sup63</sup - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018.
Recommended action: Upgrade to 0.28.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.