334 matches found
PYSEC-2026-846 Matrix Synapse DoS
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...
Matrix Synapse DoS
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...
PYSEC-2026-845 Matrix Synapse Improper Signature Validation
Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation...
PYSEC-2026-844 Matrix Synapse Authorization Error
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.powerlevels event in force...
PYSEC-2026-664 Matrix Synapse Security Filtering Flaw
The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly...
Uncontrolled Resource Consumption in Matrix Synapse
ImpactSynapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after maxspidersize default: 10M bytes have been downloaded, which can in some cases lead t...
PYSEC-2026-663 Uncontrolled Resource Consumption in Matrix Synapse
Impact Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after maxspidersize default: 10M bytes have been downloaded, which can in some cases lead ...
OPENSUSE-SU-2026:10898-1 matrix-synapse-1.153.0-2.1 on GA media
These are all security issues fixed in the matrix-synapse-1.153.0-2.1 package on the GA media of openSUSE Tumbleweed...
Improper Check for Unusual or Exceptional Conditions
Overview matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the pagination process for federated rooms. An attacker can cause clients to fail to display room...
Asymmetric Resource Consumption (Amplification)
Overview matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification through the handling of authenticated user requests. An attacker can exhaust CPU resources and cause service...
Fedora 43 : matrix-synapse / rust-pythonize (2026-151bfcc2af)
The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-151bfcc2af advisory. Update matrix-synapse to v1.147.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...
Fedora: Security Advisory (FEDORA-2026-151bfcc2af)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
OPENSUSE-SU-2026:10196-1 matrix-synapse-1.147.1-1.1 on GA media
These are all security issues fixed in the matrix-synapse-1.147.1-1.1 package on the GA media of openSUSE Tumbleweed...
Improper Validation of Specified Type of Input
Overview matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input due to insufficient validation of device keys. An attacker can disrupt federation functionality and unpredictab...
CVE-2025-61672
Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeserver...
matrix-synapse-1.139.1-1.1 on GA media (moderate)
matrix-synapse-1.139.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15603-1 Rating: moderate Cross-References: CVE-2025-61672 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
EUVD-2019-0083
Malware in sbrugna...
EUVD-2020-0108
Malware in sbrugna...