CVEvulnerability

CVE-2025-30355

7.5 HIGH Published 2025-03-27 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2025-03-27
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-20

Description

Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.

Affected configurations

• matrix synapse (< 1.127.1)

Weakness · CWE (1)

CWE-20 Improper Input Validation weakness

References

https://github.com/element-hq/synapse/commit/2277df2a1eb685f85040ef98fa21d41aa4cdd389 Patch
https://github.com/element-hq/synapse/releases/tag/v1.127.1 Release Notes
https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6 Vendor Advisory

CVE-2025-30355

Description

Affected configurations

Related

Weakness · CWE (1)

References