OPENSUSE-SU-2026:12133-1 matrix-synapse-1.163.0-1.1 on GA media

These are all security issues fixed in the matrix-synapse-1.163.0-1.1 package on the GA media of openSUSE Tumbleweed...

matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG

An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2025-61672 via matrix-synapse (0.33.9)

matrix-synapse PYPI version 0.33.9 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2025-61672 Source advisory: OSV:PYSEC-2026-1612...

matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2025-61672 via matrix-synapse (>=1.65.0, <=1.96.1)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2025-61672 Source advisory: OSV:PYSEC-2026-1612...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2025-30355 via matrix-synapse (0.33.9)

matrix-synapse PYPI version 0.33.9 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2025-30355 Source advisory: OSV:PYSEC-2026-1614...

matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2025-30355 via matrix-synapse (>=1.65.0, <=1.96.1)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2025-30355 Source advisory: OSV:PYSEC-2026-1614...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2024-52815 via matrix-synapse (0.33.9)

matrix-synapse PYPI version 0.33.9 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2024-52815 Source advisory: OSV:PYSEC-2026-1611...

matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2024-53863 via matrix-synapse (>=1.65.0, <=1.96.1)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2024-53863 Source advisory: OSV:PYSEC-2026-1615...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2024-53863 via matrix-synapse (0.33.9)

matrix-synapse PYPI version 0.33.9 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2024-53863 Source advisory: OSV:PYSEC-2026-1615...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2024-52805 via matrix-synapse (0.33.9)

matrix-synapse PYPI version 0.33.9 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2024-52805 Source advisory: OSV:PYSEC-2026-1613...

matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2024-52805 via matrix-synapse (>=1.65.0, <=1.96.1)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2024-52805 Source advisory: OSV:PYSEC-2026-1613...

matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2024-52815 via matrix-synapse (>=1.65.0, <=1.96.1)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2024-52815 Source advisory: OSV:PYSEC-2026-1611...

PYSEC-2026-846 Matrix Synapse DoS

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

Matrix Synapse DoS

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

PYSEC-2026-845 Matrix Synapse Improper Signature Validation

Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation...

PYSEC-2026-844 Matrix Synapse Authorization Error

In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.powerlevels event in force...

Matrix Synapse Improper Signature Validation

Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation...

Matrix Synapse Authorization Error

In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.powerlevels event in force...

PYSEC-2026-664 Matrix Synapse Security Filtering Flaw

The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly...

Matrix Synapse Security Filtering Flaw

The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly...