PatchTheCVE: matrix

CVE-2025-66622: matrix-sdk-base is the base component to build a Matrix client library

Wed, 07 Oct 2026 20:10:01 +0000

HIGH 7.5: matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with

CVE-2025-30355: Synapse is an open source Matrix homeserver implementation

Wed, 17 Jun 2026 09:08:34 +0000

HIGH 7.1: Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workaround

CVE-2025-27146: matrix-appservice-irc is a Node.js IRC bridge for Matrix

Wed, 17 Jun 2026 09:03:05 +0000

LOW 2.7: matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has

CVE-2024-53863: Synapse is an open-source Matrix homeserver

Wed, 17 Jun 2026 08:09:26 +0000

CRITICAL 9.1: Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for pr

CVE-2024-52815: Synapse is an open-source Matrix homeserver

Wed, 17 Jun 2026 08:07:40 +0000

MEDIUM 5.3: Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Synapse 1.120.1 rejects such

CVE-2024-52805: Synapse is an open-source Matrix homeserver

Wed, 17 Jun 2026 08:07:39 +0000

HIGH 7.5: Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 reso

CVE-2024-37303: Synapse is an open-source Matrix homeserver

Wed, 17 Jun 2026 07:38:06 +0000

MEDIUM 5.3: Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the lo

CVE-2024-37302: Synapse is an open-source Matrix homeserver

Wed, 17 Jun 2026 07:38:06 +0000

HIGH 7.5: Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead

CVE-2024-45193: An issue was discovered in Matrix libolm through 3.2.16

Wed, 17 Jun 2026 07:53:46 +0000

MEDIUM 4.3: An issue was discovered in Matrix libolm through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does not ensure that S < n). This refers to the libolm implementation of Olm. NOTE: This vulnerability only affects products that are no longer supported by the mainta

CVE-2024-45192: An issue was discovered in Matrix libolm through 3.2.16

Wed, 17 Jun 2026 07:53:46 +0000

MEDIUM 5.3: An issue was discovered in Matrix libolm through 3.2.16. Cache-timing attacks can occur due to use of base64 when decoding group session keys. This refers to the libolm implementation of Olm. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2024-45191: An issue was discovered in Matrix libolm through 3.2.16

Wed, 17 Jun 2026 07:53:46 +0000

MEDIUM 5.3: An issue was discovered in Matrix libolm through 3.2.16. The AES implementation is vulnerable to cache-timing attacks due to use of S-boxes. This is related to software that uses a lookup table for the SubWord step. This refers to the libolm implementation of Olm. NOTE: This vulnerability only affec

CVE-2024-42369: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript

Wed, 17 Jun 2026 07:49:20 +0000

MEDIUM 4.1: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This me

CVE-2024-42347: matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page

Wed, 17 Jun 2026 07:49:18 +0000

HIGH 7.7: matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the se