matrix-synapse
Homeserver for the Matrix decentralised comms protocol
v1.150.0
HIGH
URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths
CVE-2022-31052 · PYSEC-2022-224
MODERATE
Cross-site scripting (XSS) vulnerability in the password reset endpoint
CVE-2021-21332 · PYSEC-2021-133
MODERATE
Synapse has improper checks for deactivated users during login
CVE-2023-32682 · PYSEC-2023-84
MODERATE
Denial of service attack via .well-known lookups
CVE-2021-21274 · PYSEC-2021-132
MODERATE
Synapse V2 state resolution weakness allows Denial of Service (DoS)
CVE-2024-31208 · PYSEC-2024-50
HIGH
Path traversal in Matrix Synapse
CVE-2021-41281 · PYSEC-2021-436
LOW
Improper authorisation of members discloses room membership to non-members
CVE-2021-39164 · PYSEC-2021-425
MODERATE
Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
CVE-2020-26891 · PYSEC-2020-238
HIGH
Synapse does not apply enough checks to servers requesting auth events of events in a room
CVE-2022-39335 · PYSEC-2023-65
MODERATE
Uncontrolled Resource Consumption in Matrix Synapse
CVE-2022-41952
LOW
matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes
CVE-2023-41335 · PYSEC-2023-185
HIGH
HIGH
Denial of service attack due to invalid JSON
CVE-2020-26890 · PYSEC-2020-237
MODERATE
MODERATE
matrix-synapse vulnerable to denial of service due to malicious server ACL events
CVE-2023-45129 · PYSEC-2023-199
HIGH
Open redirect via transitional IPv6 addresses on dual-stack networks
CVE-2021-21392 · PYSEC-2021-25
MODERATE
matrix-synapse vulnerable to improper validation of receipts allows forged read receipts
CVE-2023-42453 · PYSEC-2023-180
MODERATE
Synapse has URL deny list bypass via oEmbed and image URLs when generating previews
CVE-2023-32683 · PYSEC-2023-85
MODERATE
HTML injection in email and account expiry notifications
CVE-2021-21333 · PYSEC-2021-134
HIGH
Matrix Synapse Authorization Error
CVE-2018-12423
HIGH
Improper Verification of Cryptographic Signature in matrix-synapse
CVE-2019-18835 · PYSEC-2019-186
HIGH
MODERATE
Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
CVE-2023-32323 · PYSEC-2023-67
MODERATE
HIGH
Matrix Synapse Improper Signature Validation
CVE-2018-16515
MODERATE
HIGH
matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG
CVE-2019-11842 · PYSEC-2019-185
HIGH
Denial of service attack via incorrect parameters in Matrix Synapse
CVE-2020-26257 · PYSEC-2020-236
HIGH
Denial of service due to incorrect application of event authorization rules
CVE-2022-31152 · PYSEC-2022-262
LOW
Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
CVE-2021-39163 · PYSEC-2021-424
MODERATE
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
CVE-2021-21393 · PYSEC-2021-26
HIGH
Matrix Synapse Predictable Secret Key
CVE-2019-5885 · PYSEC-2019-187
MODERATE
Synapse vulnerable to leak of remote user device information
CVE-2023-43796 · PYSEC-2023-230
HIGH
Synapse Denial of service due to incorrect application of event authorization rules during state resolution
CVE-2022-39374 · PYSEC-2023-66
HIGH
HIGH
HIGH
Matrix Synapse Security Filtering Flaw
CVE-2018-12291
MODERATE
Open redirects on some federation and push requests
CVE-2021-21273 · PYSEC-2021-131
HIGH
Matrix Synapse DoS
CVE-2018-10657
HIGH
MODERATE
Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
CVE-2021-21394 · PYSEC-2021-27
MODERATE
Denial of service attack via push rule patterns in matrix-synapse
CVE-2021-29471 · PYSEC-2021-135
UNKNOWN
PYSEC-2019-185
CVE-2019-11842 · GHSA-gwf7-vfjf-wf6x
UNKNOWN
PYSEC-2019-186
CVE-2019-18835 · GHSA-cppw-2mf8-qpm5
UNKNOWN
PYSEC-2019-187
CVE-2019-5885 · GHSA-jrqm-v8cv-53ww
UNKNOWN
PYSEC-2020-236
CVE-2020-26257 · GHSA-hxmp-pqch-c8mm
UNKNOWN
PYSEC-2020-237
CVE-2020-26890 · GHSA-4mp3-385r-v63f
UNKNOWN
PYSEC-2020-238
CVE-2020-26891 · GHSA-3x8c-fmpc-5rmq
UNKNOWN
PYSEC-2021-131
CVE-2021-21273 · GHSA-v936-j8gp-9q3p
UNKNOWN
PYSEC-2021-132
CVE-2021-21274 · GHSA-2hwx-mjrm-v3g8
UNKNOWN
PYSEC-2021-133
CVE-2021-21332 · GHSA-246w-56m2-5899
UNKNOWN
PYSEC-2021-134
CVE-2021-21333 · GHSA-c5f8-35qr-q4fm
UNKNOWN
PYSEC-2021-135
CVE-2021-29471 · GHSA-x345-32rc-8h85
UNKNOWN
PYSEC-2021-25
CVE-2021-21392 · GHSA-5wrh-4jwv-5w78
UNKNOWN
PYSEC-2021-26
CVE-2021-21393 · GHSA-jrh7-mhhx-6h88
UNKNOWN
PYSEC-2021-27
CVE-2021-21394 · GHSA-w9fg-xffh-p362
UNKNOWN
PYSEC-2021-424
CVE-2021-39163 · GHSA-jj53-8fmw-f2w2
UNKNOWN
PYSEC-2021-425
CVE-2021-39164 · GHSA-3x4c-pq33-4w3q
UNKNOWN
PYSEC-2021-436
CVE-2021-41281 · GHSA-3hfw-x7gx-437c
UNKNOWN
PYSEC-2022-224
CVE-2022-31052 · GHSA-22p3-qrh9-cx32
UNKNOWN
PYSEC-2022-262
CVE-2022-31152 · GHSA-jhjh-776m-4765
UNKNOWN
PYSEC-2023-180
CVE-2023-42453 · GHSA-7565-cq32-vx2x
UNKNOWN
PYSEC-2023-185
CVE-2023-41335 · GHSA-4f74-84v3-j9q5
UNKNOWN
PYSEC-2023-199
CVE-2023-45129 · GHSA-5chr-wjw5-3gq4
UNKNOWN
PYSEC-2023-230
CVE-2023-43796 · GHSA-mp92-3jfm-3575
UNKNOWN
PYSEC-2023-65
CVE-2022-39335 · GHSA-45cj-f97f-ggwv
UNKNOWN
PYSEC-2023-66
CVE-2022-39374 · GHSA-p9qp-c452-f9r7
UNKNOWN
PYSEC-2023-67
CVE-2023-32323 · GHSA-f3wc-3vxv-xmvr
UNKNOWN
PYSEC-2023-84
CVE-2023-32682 · GHSA-26c5-ppr8-f33p
UNKNOWN
PYSEC-2023-85
CVE-2023-32683 · GHSA-98px-6486-j7qc
UNKNOWN
PYSEC-2024-50
CVE-2024-31208 · GHSA-3h7q-rfh9-xm4v
Exclude CI/CDPRO
Download Trend
Badge
Markdown
[](/packages/matrix-synapse)
HTML
<a href="/packages/matrix-synapse"><img src="/api/badges/matrix-synapse?period=month" alt="PyPI Stats"></a>