GitHub Advisoryadvisory · PyPI

GHSA-v56r-hwv5-mxg6 Synapse vulnerable to federation denial of service via malformed events

HIGH Published 2025-03-27 Modified 2025-10-24 Official page ↗
Aliases
CVE-2025-30355
Ecosystem
PyPI
Packages
matrix-synapse
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-20
Reviewed
2025-03-27

Affected packages

• PyPI matrix-synapse: < 1.127.1 → fixed in 1.127.1

Description

Impact A malicious server can craft events with a `depth` outside the integer range allowed by Canonical JSON. When such an event is received by Synapse version up to 1.127.0, it prevents it from federating with other servers. The vulnerability has been exploited in the wild. Patches Fixed in Synapse v1.127.1. Workarounds Closed federation environments of trusted servers or non-federating installations are not affected. For more information If you have any questions or comments about this advisory, please email us at security at element.io.

Related

Alias · CVE (1)

  • CVE-2025-30355 Synapse is an open source Matrix homeserver implementation. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References