matrix-synapse (PyPI)
Advisories
91
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.152.1 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "matrix-synapse>=1.152.1"poetry
poetry add "matrix-synapse>=1.152.1"uv
uv add "matrix-synapse>=1.152.1"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6qf2-7x63-mm6v Synapse pagination Denial of Service |
Low EPSS 0.37% |
< 1.152.1 | 1.152.1 |
| GHSA-6qf2-7x63-mm6v Synapse pagination Denial of Service |
Low EPSS 0.37% |
< 1.152.1 | 1.152.1 |
| GHSA-8q93-326v-3m7g Synapse CPU starvation (Denial of Service) |
Medium EPSS 0.13% |
< 1.152.1 | 1.152.1 |
| GHSA-8q93-326v-3m7g Synapse CPU starvation (Denial of Service) |
Medium EPSS 0.13% |
< 1.152.1 | 1.152.1 |
| GHSA-fh66-fcv5-jjfr Synapse's invalid device keys degrade federation functionality |
Medium EPSS 0.48% |
>= 1.139.0rc2, < 1.139.1 | 1.139.1 |
| GHSA-fh66-fcv5-jjfr Synapse's invalid device keys degrade federation functionality |
Medium EPSS 0.48% |
< 1.138.3 | 1.138.3 |
| GHSA-fh66-fcv5-jjfr Synapse's invalid device keys degrade federation functionality |
Medium EPSS 0.48% |
< 1.138.3>= 1.139.0rc2, < 1.139.1 | 1.138.31.139.1 |
| GHSA-v56r-hwv5-mxg6 Synapse vulnerable to federation denial of service via malformed events |
High EPSS 1.23% |
< 1.127.1 | 1.127.1 |
| GHSA-v56r-hwv5-mxg6 Synapse vulnerable to federation denial of service via malformed events |
High EPSS 1.23% |
< 1.127.1 | 1.127.1 |
| GHSA-56w4-5538-8v8h Synapse Matrix has a partial room state leak via Sliding Sync |
Medium EPSS 0.44% |
>= 1.113.0rc1, < 1.120.1 | 1.120.1 |
| GHSA-56w4-5538-8v8h Synapse Matrix has a partial room state leak via Sliding Sync |
Medium EPSS 0.44% |
>= 1.113.0rc1, < 1.120.1 | 1.120.1 |
| GHSA-vp6v-whfm-rv3g Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders |
Critical EPSS 0.61% |
< 1.120.1 | 1.120.1 |
| GHSA-vp6v-whfm-rv3g Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders |
Critical EPSS 0.61% |
< 1.120.1 | 1.120.1 |
| GHSA-f3r3-h2mq-hx2h Synapse allows a a malformed invite to break the invitee's `/sync` |
Medium EPSS 0.57% |
< 1.120.1 | 1.120.1 |
| GHSA-f3r3-h2mq-hx2h Synapse allows a a malformed invite to break the invitee's `/sync` |
Medium EPSS 0.57% |
< 1.120.1 | 1.120.1 |
| GHSA-rfq8-j7rh-8hf2 Synapse allows unsupported content types to lead to memory exhaustion |
High EPSS 0.74% |
< 1.120.1 | 1.120.1 |
| GHSA-rfq8-j7rh-8hf2 Synapse allows unsupported content types to lead to memory exhaustion |
High EPSS 0.74% |
< 1.120.1 | 1.120.1 |
| GHSA-gjgr-7834-rhxr Synapse's unauthenticated writes to the media repository allow planting of problematic content |
Medium EPSS 0.43% |
< 1.106.0 | 1.106.0 |
| GHSA-gjgr-7834-rhxr Synapse's unauthenticated writes to the media repository allow planting of problematic content |
Medium EPSS 0.43% |
< 1.106 | 1.106 |
| GHSA-4mhg-xv73-xq2x Synapse denial of service through media disk space consumption |
High EPSS 0.60% |
< 1.106.0 | 1.106.0 |
| GHSA-4mhg-xv73-xq2x Synapse denial of service through media disk space consumption |
High EPSS 0.60% |
< 1.106 | 1.106 |
| GHSA-3h7q-rfh9-xm4v Synapse V2 state resolution weakness allows Denial of Service (DoS) |
Medium EPSS 1.46% |
< 1.105.1 | 1.105.1 |
| GHSA-3h7q-rfh9-xm4v Synapse V2 state resolution weakness allows Denial of Service (DoS) |
Medium EPSS 1.46% |
< 1.105.1 | 1.105.1 |
| GHSA-mp92-3jfm-3575 Synapse vulnerable to leak of remote user device information |
Medium EPSS 0.90% |
< 1.95.1 | 1.95.1 |
| GHSA-mp92-3jfm-3575 Synapse vulnerable to leak of remote user device information |
Medium EPSS 0.90% |
< 1.95.1 | 1.95.1 |
| GHSA-5chr-wjw5-3gq4 matrix-synapse vulnerable to denial of service due to malicious server ACL events |
Medium EPSS 1.39% |
< 1.94.0 | 1.94.0 |
| GHSA-5chr-wjw5-3gq4 matrix-synapse vulnerable to denial of service due to malicious server ACL events |
Medium EPSS 1.39% |
< 1.94.0 | 1.94.0 |
| GHSA-7565-cq32-vx2x matrix-synapse vulnerable to improper validation of receipts allows forged read receipts |
Medium EPSS 0.78% |
>= 0.34.0, < 1.93.0 | 1.93.0 |
| GHSA-7565-cq32-vx2x matrix-synapse vulnerable to improper validation of receipts allows forged read receipts |
Medium EPSS 0.78% |
>= 1.34.0, < 1.93.0 | 1.93.0 |
| GHSA-4f74-84v3-j9q5 matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes |
Low EPSS 0.39% |
>= 1.66.0, < 1.93.0 | 1.93.0 |
| GHSA-4f74-84v3-j9q5 matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes |
Low EPSS 0.39% |
>= 1.66.0, < 1.93.0 | 1.93.0 |
| GHSA-98px-6486-j7qc Synapse has URL deny list bypass via oEmbed and image URLs when generating previews |
Low EPSS 0.60% |
< 1.85.0 | 1.85.0 |
| GHSA-98px-6486-j7qc Synapse has URL deny list bypass via oEmbed and image URLs when generating previews |
Low EPSS 0.60% |
< 1.85.0 | 1.85.0 |
| GHSA-26c5-ppr8-f33p Synapse has improper checks for deactivated users during login |
Medium EPSS 0.75% |
< 1.85.0 | 1.85.0 |
| GHSA-26c5-ppr8-f33p Synapse has improper checks for deactivated users during login |
Medium EPSS 0.75% |
< 1.85.0 | 1.85.0 |
| GHSA-f3wc-3vxv-xmvr Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites |
Medium EPSS 0.98% |
< 1.74.0 | 1.74.0 |
| GHSA-f3wc-3vxv-xmvr Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites |
Medium EPSS 0.98% |
< 1.74.0 | 1.74.0 |
| GHSA-p9qp-c452-f9r7 Synapse Denial of service due to incorrect application of event authorization rules during state resolution |
Medium EPSS 0.94% |
>= 1.62.0, < 1.68.0rc1 | 1.68.0rc1 |
| GHSA-p9qp-c452-f9r7 Synapse Denial of service due to incorrect application of event authorization rules during state resolution |
Medium EPSS 0.94% |
>= 1.62.0, < 1.68.0 | 1.68.0 |
| GHSA-45cj-f97f-ggwv Synapse does not apply enough checks to servers requesting auth events of events in a room |
Medium EPSS 0.64% |
< 1.69.0 | 1.69.0 |
| GHSA-45cj-f97f-ggwv Synapse does not apply enough checks to servers requesting auth events of events in a room |
Medium EPSS 0.64% |
< 1.69.0 | 1.69.0 |
| GHSA-jhjh-776m-4765 Denial of service due to incorrect application of event authorization rules |
High EPSS 1.20% |
< 1.62.0 | 1.62.0 |
| GHSA-jhjh-776m-4765 Denial of service due to incorrect application of event authorization rules |
High EPSS 1.20% |
< 1.62.0rc1 | 1.62.0rc1 |
| GHSA-22p3-qrh9-cx32 URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths |
Medium EPSS 1.66% |
< 1.61.1 | 1.61.1 |
| GHSA-22p3-qrh9-cx32 URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths |
Medium EPSS 1.66% |
< 1.61.1 | 1.61.1 |
| GHSA-vmcc-4p4x-x7wg Matrix Synapse DoS |
High EPSS 1.49% |
< 0.28.1 | 0.28.1 |
| GHSA-vmcc-4p4x-x7wg Matrix Synapse DoS |
High EPSS 1.49% |
< 0.28.1 | 0.28.1 |
| GHSA-fmvh-rvq5-hhjx Matrix Synapse Improper Signature Validation |
High EPSS 1.54% |
< 0.33.2.1>= 0.33.3, < 0.33.3.1 | 0.33.2.10.33.3.1 |
| GHSA-fmvh-rvq5-hhjx Matrix Synapse Improper Signature Validation |
High EPSS 1.54% |
>= 0.33.3, < 0.33.3.1 | 0.33.3.1 |
| GHSA-fmvh-rvq5-hhjx Matrix Synapse Improper Signature Validation |
High EPSS 1.54% |
< 0.33.2.1 | 0.33.2.1 |
| GHSA-ch5v-fhg8-7gv9 Matrix Synapse Authorization Error |
High EPSS 1.81% |
< 0.31.2 | 0.31.2 |
| GHSA-ch5v-fhg8-7gv9 Matrix Synapse Authorization Error |
High EPSS 1.81% |
< 0.31.2 | 0.31.2 |
| GHSA-v8wm-g9f2-xjv4 Matrix Synapse Security Filtering Flaw |
High EPSS 1.79% |
< 0.31.1 | 0.31.1 |
| GHSA-v8wm-g9f2-xjv4 Matrix Synapse Security Filtering Flaw |
High EPSS 1.79% |
< 0.31.1 | 0.31.1 |
| GHSA-4822-jvwx-w47h Uncontrolled Resource Consumption in Matrix Synapse |
Medium EPSS 0.94% |
< 1.53.0 | 1.53.0 |
| GHSA-4822-jvwx-w47h Uncontrolled Resource Consumption in Matrix Synapse |
Medium EPSS 0.94% |
< 1.53.0 | 1.53.0 |
| GHSA-3hfw-x7gx-437c Path traversal in Matrix Synapse |
High EPSS 1.58% |
< 1.47.1 | 1.47.1 |
| GHSA-3hfw-x7gx-437c Path traversal in Matrix Synapse |
High EPSS 1.58% |
< 1.47.1 | 1.47.1 |
| GHSA-3x4c-pq33-4w3q Improper authorisation of members discloses room membership to non-members |
Low EPSS 1.45% |
< 1.41.1 | 1.41.1 |
| GHSA-3x4c-pq33-4w3q Improper authorisation of members discloses room membership to non-members |
Low EPSS 1.45% |
< 1.41.1 | 1.41.1 |
| GHSA-jj53-8fmw-f2w2 Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. |
Low EPSS 0.90% |
< 1.41.1 | 1.41.1 |
| GHSA-jj53-8fmw-f2w2 Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. |
Low EPSS 0.90% |
< 1.41.1 | 1.41.1 |
| GHSA-7h5v-85w9-pq6c Denial of service (via resource exhaustion) due to improper input validation in third-party identifier endpoint |
Medium | < 1.33.0 | 1.33.0 |
| GHSA-x345-32rc-8h85 Denial of service attack via push rule patterns in matrix-synapse |
Low EPSS 1.65% |
< 1.33.2 | 1.33.2 |
| GHSA-x345-32rc-8h85 Denial of service attack via push rule patterns in matrix-synapse |
Low EPSS 1.65% |
< 1.33.2 | 1.33.2 |
| GHSA-jrh7-mhhx-6h88 Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints |
Medium EPSS 1.60% |
< 1.28.0 | 1.28.0 |
| GHSA-5wrh-4jwv-5w78 Open redirect via transitional IPv6 addresses on dual-stack networks |
Medium EPSS 0.94% |
< 1.28.0 | 1.28.0 |
| GHSA-5wrh-4jwv-5w78 Open redirect via transitional IPv6 addresses on dual-stack networks |
Medium EPSS 0.94% |
< 1.28.0rc1 | 1.28.0rc1 |
| GHSA-jrh7-mhhx-6h88 Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints |
Medium EPSS 1.60% |
< 1.28.0 | 1.28.0 |
| GHSA-w9fg-xffh-p362 Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints |
Medium EPSS 1.54% |
< 1.28.0 | 1.28.0 |
| GHSA-w9fg-xffh-p362 Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints |
Medium EPSS 1.54% |
< 1.28.0 | 1.28.0 |
| GHSA-c5f8-35qr-q4fm HTML injection in email and account expiry notifications |
Medium EPSS 1.35% |
< 1.27.0 | 1.27.0 |
| GHSA-c5f8-35qr-q4fm HTML injection in email and account expiry notifications |
Medium EPSS 1.35% |
< 1.27.0 | 1.27.0 |
| GHSA-246w-56m2-5899 Cross-site scripting (XSS) vulnerability in the password reset endpoint |
Medium EPSS 1.22% |
< 1.27.0 | 1.27.0 |
| GHSA-246w-56m2-5899 Cross-site scripting (XSS) vulnerability in the password reset endpoint |
Medium EPSS 1.22% |
< 1.27.0 | 1.27.0 |
| GHSA-2hwx-mjrm-v3g8 Denial of service attack via .well-known lookups |
Medium EPSS 2.16% |
>= 0.99.0, < 1.25.0 | 1.25.0 |
| GHSA-2hwx-mjrm-v3g8 Denial of service attack via .well-known lookups |
Medium EPSS 2.16% |
>= 0.99.0, < 1.25.0 | 1.25.0 |
| GHSA-v936-j8gp-9q3p Open redirects on some federation and push requests |
Low EPSS 1.80% |
< 1.25.0 | 1.25.0 |
| GHSA-v936-j8gp-9q3p Open redirects on some federation and push requests |
Low EPSS 1.80% |
< 1.25.0 | 1.25.0 |
| GHSA-hxmp-pqch-c8mm Denial of service attack via incorrect parameters in Matrix Synapse |
Medium EPSS 2.39% |
< 1.23.1 | 1.23.1 |
| GHSA-hxmp-pqch-c8mm Denial of service attack via incorrect parameters in Matrix Synapse |
Medium EPSS 2.39% |
< 1.23.1 | 1.23.1 |
| GHSA-4mp3-385r-v63f Denial of service attack due to invalid JSON |
High EPSS 3.00% |
< 1.20.0 | 1.20.0 |
| GHSA-4mp3-385r-v63f Denial of service attack due to invalid JSON |
High EPSS 3.00% |
< 1.20.0 | 1.20.0 |
| GHSA-3x8c-fmpc-5rmq Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint |
Medium EPSS 1.92% |
< 1.21.0 | 1.21.0 |
| GHSA-3x8c-fmpc-5rmq Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint |
Medium EPSS 1.92% |
< 1.21.0 | 1.21.0 |
| GHSA-cppw-2mf8-qpm5 Improper Verification of Cryptographic Signature in matrix-synapse |
High EPSS 0.86% |
< 1.5.0 | 1.5.0 |
| GHSA-cppw-2mf8-qpm5 Improper Verification of Cryptographic Signature in matrix-synapse |
High EPSS 0.86% |
< 1.5.0 | 1.5.0 |
| GHSA-gwf7-vfjf-wf6x matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG |
High EPSS 1.80% |
< 0.99.3.1 | 0.99.3.1 |
| GHSA-gwf7-vfjf-wf6x matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG |
High EPSS 1.80% |
< 0.99.3.1 | 0.99.3.1 |
| GHSA-jrqm-v8cv-53ww Matrix Synapse Predictable Secret Key |
High EPSS 2.44% |
< 0.34.0.1 | 0.34.0.1 |
| GHSA-jrqm-v8cv-53ww Matrix Synapse Predictable Secret Key |
High EPSS 2.44% |
< 0.34.0.1 | 0.34.0.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor