GitHub Advisoryadvisory · PyPI

GHSA-fh66-fcv5-jjfr Synapse's invalid device keys degrade federation functionality

MEDIUM Published 2025-10-08 Modified 2025-10-08 Official page ↗
Aliases
CVE-2025-61672
Ecosystem
PyPI
Packages
matrix-synapse
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-1287
Reviewed
2025-10-08

Affected packages

• PyPI matrix-synapse: < 1.138.3 → fixed in 1.138.3 • PyPI matrix-synapse: >= 1.139.0rc2, < 1.139.1 → fixed in 1.139.1

Description

Impact Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. Patches Patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2. Workarounds The vulnerability can only be exploited by users registered on the victim homeserver.

Related

Alias · CVE (1)

  • CVE-2025-61672 Synapse is an open source Matrix homeserver implementation. vulnerability

Weakness · CWE (1)

  • CWE-1287 Improper Validation of Specified Type of Input weakness

References