github - ghsa-v56r-hwv5-mxg6

ghsa-v56r-hwv5-mxg6

Vulnerability from github

Published

2025-03-27 18:02

Modified

2025-03-27 18:02

Severity ?

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Summary

Synapse vulnerable to federation denial of service via malformed events

Details

Impact

A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild.

Patches

Fixed in Synapse v1.127.1.

Workarounds

Closed federation environments of trusted servers or non-federating installations are not affected.

For more information

If you have any questions or comments about this advisory, please email us at security at element.io.

Show details on source website

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-synapse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.127.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-30355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-27T18:02:14Z",
    "nvd_published_at": "2025-03-27T01:15:12Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nA malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild.\n\n### Patches\nFixed in Synapse v1.127.1.\n\n### Workarounds\nClosed federation environments of trusted servers or non-federating installations are not affected.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).",
  "id": "GHSA-v56r-hwv5-mxg6",
  "modified": "2025-03-27T18:02:14Z",
  "published": "2025-03-27T18:02:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30355"
    },
    {
      "type": "WEB",
      "url": "https://github.com/element-hq/synapse/commit/2277df2a1eb685f85040ef98fa21d41aa4cdd389"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/element-hq/synapse"
    },
    {
      "type": "WEB",
      "url": "https://github.com/element-hq/synapse/releases/tag/v1.127.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Synapse vulnerable to federation denial of service via malformed events"
}

cve-2025-30355

Vulnerability from cvelistv5

Published

2025-03-27 00:59

Modified

2025-03-27 13:47

Severity ?

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Summary

Synapse vulnerable to federation denial of service via malformed events

References

▼	URL	Tags
	https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6	x_refsource_CONFIRM
	https://github.com/element-hq/synapse/commit/2277df2a1eb685f85040ef98fa21d41aa4cdd389	x_refsource_MISC
	https://github.com/element-hq/synapse/releases/tag/v1.127.1	x_refsource_MISC

Impacted products

▼	Vendor	Product
	element-hq	synapse

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30355",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-27T13:47:41.011255Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T13:47:50.179Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "synapse",
          "vendor": "element-hq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.127.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-27T00:59:27.996Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6"
        },
        {
          "name": "https://github.com/element-hq/synapse/commit/2277df2a1eb685f85040ef98fa21d41aa4cdd389",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/element-hq/synapse/commit/2277df2a1eb685f85040ef98fa21d41aa4cdd389"
        },
        {
          "name": "https://github.com/element-hq/synapse/releases/tag/v1.127.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/element-hq/synapse/releases/tag/v1.127.1"
        }
      ],
      "source": {
        "advisory": "GHSA-v56r-hwv5-mxg6",
        "discovery": "UNKNOWN"
      },
      "title": "Synapse vulnerable to federation denial of service via malformed events"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-30355",
    "datePublished": "2025-03-27T00:59:27.996Z",
    "dateReserved": "2025-03-21T14:12:06.270Z",
    "dateUpdated": "2025-03-27T13:47:50.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.