CVE-2022-31152
Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting federation_domain_whitelist to an empty list ([]) as a workaround.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting federation_domain_whitelist to an empty list ([]) as a workaround.
- Record
CVE-2022-31152- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-703
- Updated
- 2026-11-02
EUVDEUVD-2022-0154
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting federation_domain_whitelist to an empty list ([]) as a workaround.
- Record
EUVD-2022-0154- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jhjh-776m-4765
Denial of service due to incorrect application of event authorization rules
Impact
The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room.
In versions of Synapse up to and including v1.61, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers.
Patches
Administrators of homeservers with federation enabled are advised to upgrade to v1.62.0 or higher.
Workarounds
- Federation can be disabled by setting
federation_domain_whitelistto an empty list ([]).
References
For more information
If you have any questions or comments about this advisory, e-mail us at [email protected].
- Record
GHSA-jhjh-776m-4765- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-703, CWE-755
- Updated
- 2026-11-02
NVD
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting federation_domain_whitelist to an empty list ([]) as a workaround.
- Record
CVE-2022-31152- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-703, CWE-755
- Updated
- 2026-11-02
OSV
Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting federation_domain_whitelist to an empty list ([]) as a workaround.
- Record
CVE-2022-31152- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-703
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-31152
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting federation_domain_whitelist to an empty list ([]) as a workaround.
- Record
DEBIAN-CVE-2022-31152- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-jhjh-776m-4765
Denial of service due to incorrect application of event authorization rules
Impact
The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room.
In versions of Synapse up to and including v1.61, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers.
Patches
Administrators of homeservers with federation enabled are advised to upgrade to v1.62.0 or higher.
Workarounds
- Federation can be disabled by setting
federation_domain_whitelistto an empty list ([]).
References
For more information
If you have any questions or comments about this advisory, e-mail us at [email protected].
- Record
GHSA-jhjh-776m-4765- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-703, CWE-755
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-31152
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting federation_domain_whitelist to an empty list ([]) as a workaround.
- Record
UBUNTU-CVE-2022-31152- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVPYSEC-2022-262 No score
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting federation_domain_whitelist to an empty list ([]) as a workaround.
- Record
PYSEC-2022-262- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-synapsePyPI |
before 1.62.0rc1 | 1.62.0rc1 |
matrix-synapsePyPI |
before 1.62.0rc1, plus listed versions 0.33.50.33.5.10.33.60.33.6rc10.33.7 Show 45 moreShow less0.33.7rc10.33.7rc20.33.80.33.8rc20.33.90.34.00.34.0.10.34.0rc10.34.0rc20.34.1.10.99.00.99.0rc10.99.0rc20.99.0rc30.99.0rc40.99.10.99.1.10.99.1rc10.99.1rc20.99.20.99.2rc10.99.30.99.3.10.99.3.20.99.3rc10.99.40.99.4rc10.99.50.99.5.10.99.5.20.99.5rc11.0.01.0.0rc11.0.0rc21.0.0rc31.1.01.1.0rc11.1.0rc21.10.01.10.0rc11.10.0rc21.10.0rc31.10.0rc51.10.11.11.0 |
1.62.0rc1 |
matrix-synapsePyPI |
before 1.62.0, plus listed versions 0.33.50.33.5.10.33.60.33.6rc10.33.7 Show 45 moreShow less0.33.7rc10.33.7rc20.33.80.33.8rc20.33.90.34.00.34.0.10.34.0rc10.34.0rc20.34.1.10.99.00.99.0rc10.99.0rc20.99.0rc30.99.0rc40.99.10.99.1.10.99.1rc10.99.1rc20.99.20.99.2rc10.99.30.99.3.10.99.3.20.99.3rc10.99.40.99.4rc10.99.50.99.5.10.99.5.20.99.5rc11.0.01.0.0rc11.0.0rc21.0.0rc31.1.01.1.0rc11.1.0rc21.10.01.10.0rc11.10.0rc21.10.0rc31.10.0rc51.10.11.11.0 |
1.62.0 |
matrix-synapseUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.19.2+dfsg-60.24.0+dfsg-10.24.0+dfsg-1ubuntu0.1~esm10.24.0+dfsg-1ubuntu0.1~esm4 |
None known |
matrix-synapseUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.3.0-11.4.0-11.5.0-11.5.1-11.6.0-1 Show 12 moreShow less1.6.1-11.7.0-21.7.1-11.7.2-11.7.3-11.8.0-11.9.0-11.9.1-11.10.0-11.10.0-21.11.0-11.11.0-1ubuntu0.1~esm2 |
None known |
matrix-synapseUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.39.0-11.47.0-21.47.1-11.48.0-11.49.0-1 Show 7 moreShow less1.49.2-11.50.1-11.50.2-11.51.0-11.52.0-11.53.0-11.53.0-1ubuntu0.1~esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31152 is a medium vulnerability (CVSS 6.4) in Element-hq Synapse, published August 31, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in matrix-synapse 1.62.0rc1.
References
github.com/matrix-org/synapse/security/advisories/GHSA-jhjh-776m-4765
nvd.nist.gov/vuln/detail/CVE-2022-31152
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2022-31152
ubuntu.com/security/CVE-2022-31152
cve.org/CVERecord?id=CVE-2022-31152
Left out here: 423 versions. The JSON record has them.