CVE-2024-52805
Synapse allows unsupported content types to lead to memory exhaustion
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Synapse allows unsupported content types to lead to memory exhaustion
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
- Record
CVE-2024-52805- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2024-3505
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
- Record
EUVD-2024-3505- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rfq8-j7rh-8hf2
Synapse allows unsupported content types to lead to memory exhaustion
Impact
In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks.
Patches
Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
Workarounds
Limiting request sizes or blocking the multipart/form-data content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low max_upload_size in Synapse.
References
- https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518
- https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
- Record
GHSA-rfq8-j7rh-8hf2- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
- Record
CVE-2024-52805- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-52805
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
- Record
ALPINE-CVE-2024-52805- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
Synapse allows unsupported content types to lead to memory exhaustion
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
- Record
CVE-2024-52805- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2024-52805
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
- Record
DEBIAN-CVE-2024-52805- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-rfq8-j7rh-8hf2
Synapse allows unsupported content types to lead to memory exhaustion
Impact
In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks.
Patches
Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
Workarounds
Limiting request sizes or blocking the multipart/form-data content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low max_upload_size in Synapse.
References
- https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518
- https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
- Record
GHSA-rfq8-j7rh-8hf2- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVPYSEC-2026-1613
Synapse allows unsupported content types to lead to memory exhaustion
Impact
In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks.
Patches
Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
Workarounds
Limiting request sizes or blocking the multipart/form-data content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low max_upload_size in Synapse.
References
- https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518
- https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
- Record
PYSEC-2026-1613- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-52805
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
- Record
UBUNTU-CVE-2024-52805- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14541-1 No score
matrix-synapse-1.120.2-1.1 on GA media
These are all security issues fixed in the matrix-synapse-1.120.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14541-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-synapsePyPI |
before 1.120.1 | 1.120.1 |
synapseAlpine:v3.20 |
before 1.120.1 | 1.120.1 |
synapseAlpine:v3.21 |
before 1.120.2-r0 | 1.120.2-r0 |
synapseAlpine:v3.22 |
before 1.120.2-r0 | 1.120.2-r0 |
synapseAlpine:v3.23 |
before 1.120.2-r0 | 1.120.2-r0 |
synapseAlpine:v3.24 |
before 1.120.2-r0 | 1.120.2-r0 |
matrix-synapsePyPI |
before 1.120.1, plus listed versions 0.33.50.33.5.10.33.60.33.6rc10.33.7 Show 45 moreShow less0.33.7rc10.33.7rc20.33.80.33.8rc20.33.90.34.00.34.0.10.34.0rc10.34.0rc20.34.1.10.99.00.99.0rc10.99.0rc20.99.0rc30.99.0rc40.99.10.99.1.10.99.1rc10.99.1rc20.99.20.99.2rc10.99.30.99.3.10.99.3.20.99.3rc10.99.40.99.4rc10.99.50.99.5.10.99.5.20.99.5rc11.0.01.0.0rc11.0.0rc21.0.0rc31.1.01.1.0rc11.1.0rc21.10.01.10.0rc11.10.0rc21.10.0rc31.10.0rc51.10.11.100.0 |
1.120.1 |
matrix-synapseUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.19.2+dfsg-60.24.0+dfsg-10.24.0+dfsg-1ubuntu0.1~esm10.24.0+dfsg-1ubuntu0.1~esm4 |
None known |
matrix-synapseUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.3.0-11.4.0-11.5.0-11.5.1-11.6.0-1 Show 12 moreShow less1.6.1-11.7.0-21.7.1-11.7.2-11.7.3-11.8.0-11.9.0-11.9.1-11.10.0-11.10.0-21.11.0-11.11.0-1ubuntu0.1~esm2 |
None known |
matrix-synapseUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.39.0-11.47.0-21.47.1-11.48.0-11.49.0-1 Show 7 moreShow less1.49.2-11.50.1-11.50.2-11.51.0-11.52.0-11.53.0-11.53.0-1ubuntu0.1~esm2 |
None known |
matrix-synapseUbuntu:24.04:LTS |
All versions, plus listed versions 1.90.0-11.100.0-1ubuntu1 |
None known |
matrix-synapseopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 1.120.2-1.1 | 1.120.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| affected | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-52805 is a high vulnerability (CVSS 8.2) in Element-hq Synapse, published December 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in matrix-synapse 1.120.1.
References
github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2
nvd.nist.gov/vuln/detail/CVE-2024-52805
security.alpinelinux.org/vuln/CVE-2024-52805
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2024-52805
pypi.org/project/matrix-synapse
ubuntu.com/security/CVE-2024-52805
cve.org/CVERecord?id=CVE-2024-52805
suse.com/security/cve/CVE-2024-37302
Left out here: 365 versions. The JSON record has them.