HIGH🇬🇧 English

CVE-2024-52805

CVSS 8.2v4.0pub. 2024-12-03upd. 2025-08-26

Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Matrix Synapse

    APP
    Matrix
    < 1.120.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
DoS
CWE
Referencje

Powiązane podatności

CVE-2019-18835CRITICAL9.8ten sam produkt

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join...

CVE-2025-30355HIGH7.1ten sam produkt

Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when re...

CVE-2024-53863HIGH8.2ten sam produkt

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnai...

CVE-2024-37302HIGH7.5ten sam produkt

Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attac...

CVE-2024-52815HIGH8.7ten sam produkt

Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites...