CVE-2018-16515
Matrix Synapse Improper Signature Validation
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
- Record
CVE-2018-16515- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-347
- Updated
- 2026-11-02
CVE List No score
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
- Record
CVE-2018-16515- Updated
- 2026-11-02
EUVDEUVD-2022-3811 No score
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
- Record
EUVD-2022-3811- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fmvh-rvq5-hhjx
Matrix Synapse Improper Signature Validation
Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
- Record
GHSA-fmvh-rvq5-hhjx- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
- Record
CVE-2018-16515- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-16515
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
- Record
DEBIAN-CVE-2018-16515- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-fmvh-rvq5-hhjx
Matrix Synapse Improper Signature Validation
Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
- Record
GHSA-fmvh-rvq5-hhjx- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVPYSEC-2026-845
Matrix Synapse Improper Signature Validation
Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
- Record
PYSEC-2026-845- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-16515
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
- Record
UBUNTU-CVE-2018-16515- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-6076-1 No score
matrix-synapse vulnerabilities
It was discovered that Synapse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2019-18835, CVE-2018-12291, CVE-2018-10657)
It was discovered that Synapse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to hijack the session. (CVE-2019-11842, CVE-2018-12423)
It was discovered that Synapse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform spoofing or user impersonation. (CVE-2019-5885, CVE-2018-16515)
- Record
USN-6076-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-synapsePyPI |
0.33.3 up to 0.33.3.1 | 0.33.3.1 |
matrix-synapsePyPI |
before 0.33.2.1 | 0.33.2.1 |
matrix-synapsePyPI |
before 0.33.2.1, 0.33.3 up to 0.33.3.1 | 0.33.2.10.33.3.1 |
matrix-synapseUbuntu:Pro:18.04:LTS |
before 0.24.0+dfsg-1ubuntu0.1~esm1, plus listed versions 0.19.2+dfsg-60.24.0+dfsg-1 |
0.24.0+dfsg-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-16515 is a high vulnerability (CVSS 8.8) in Matrix Synapse, published September 18, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 74th percentile. Fixed in matrix-synapse 0.33.3.1.
References
github.com/matrix-org/synapse/issues/3796
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRW7YR2H3ASUSYX4AO4KMY3FNVDNYW3P
matrix.org/blog/2018/09/06/critical-security-update-synapse-0-33-3-1
nvd.nist.gov/vuln/detail/CVE-2018-16515
Show 17 moreShow less
security-tracker.debian.org/tracker/CVE-2018-16515
pypi.org/project/matrix-synapse
ubuntu.com/security/CVE-2018-16515
cve.org/CVERecord?id=CVE-2018-16515