CVE-2025-30355

CVSS 7.1v3.1pub. 2025-03-27upd. 2025-08-26

Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Matrix Synapse
APP
Matrix
< 1.127.1

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

CWE

CWE-20

NVD-CWE-noinfo

References

github.com/element-hq/synapse/commit/2277df2a1eb685f850…

github.com/element-hq/synapse/releases/tag/v1.127.1…

github.com/element-hq/synapse/security/advisories/GHSA-…

Related vulnerabilities

CVE-2019-18835CRITICAL9.8ten sam produkt

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join...

CVE-2024-52815HIGH8.7ten sam produkt

Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites...

CVE-2024-52805HIGH8.2ten sam produkt

Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in ce...

CVE-2024-37302HIGH7.5ten sam produkt

Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attac...

CVE-2024-53863HIGH8.2ten sam produkt

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnai...