CVE-2020-26257

Matrix is an ecosystem for open federated Instant Messaging and VoIP.
Synapse is a reference “homeserver” implementation of Matrix. A malicious
or poorly-implemented homeserver can inject malformed events into a room by
specifying a different room id in the path of a /send_join,
/send_leave, /invite or /exchange_third_party_invite request. This
can lead to a denial of service in which future events will not be
correctly sent to other servers over federation. This affects any server
which accepts federation requests from untrusted servers. The Matrix
Synapse reference implementation before version 1.23.1 the implementation
is vulnerable to this injection attack. Issue is fixed in version 1.23.1.
As a workaround homeserver administrators could limit access to the
federation API to trusted servers (for example via
federation_domain_whitelist).