CVEvulnerability

CVE-2025-49090

7.1 HIGH Published 2025-10-02 Modified 2026-10-12 Official page ↗

Status: Deferred
Published: 2025-10-02
Last modified: 2026-10-12
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Weaknesses: CWE-642

Description

The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.

Related

Weakness · CWE (1)

CWE-642 External Control of Critical State Data weakness

References

https://github.com/Nheko-Reborn/nheko/issues/1931 github.com
https://github.com/matrix-org/matrix-spec/releases/tag/v1.16 github.com
https://matrix.org/blog/2025/08/project-hydra-improving-state-res/ matrix.org
https://matrix.org/blog/2025/08/security-release/ matrix.org