CVE-2025-30355
Synapse vulnerable to federation denial of service via malformed events
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Synapse vulnerable to federation denial of service via malformed events
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
- Record
CVE-2025-30355- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2025-8265
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
- Record
EUVD-2025-8265- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v56r-hwv5-mxg6
Synapse vulnerable to federation denial of service via malformed events
Impact
A malicious server can craft events with a depth outside the integer range allowed by Canonical JSON. When such an event is received by Synapse version up to 1.127.0, it prevents it from federating with other servers. The vulnerability has been exploited in the wild.
Patches
Fixed in Synapse v1.127.1.
Workarounds
Closed federation environments of trusted servers or non-federating installations are not affected.
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
- Record
GHSA-v56r-hwv5-mxg6- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
- Record
CVE-2025-30355- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-30355
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
- Record
ALPINE-CVE-2025-30355- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
Synapse vulnerable to federation denial of service via malformed events
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
- Record
CVE-2025-30355- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2025-30355
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
- Record
DEBIAN-CVE-2025-30355- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-v56r-hwv5-mxg6
Synapse vulnerable to federation denial of service via malformed events
Impact
A malicious server can craft events with a depth outside the integer range allowed by Canonical JSON. When such an event is received by Synapse version up to 1.127.0, it prevents it from federating with other servers. The vulnerability has been exploited in the wild.
Patches
Fixed in Synapse v1.127.1.
Workarounds
Closed federation environments of trusted servers or non-federating installations are not affected.
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
- Record
GHSA-v56r-hwv5-mxg6- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2026-1614
Synapse vulnerable to federation denial of service via malformed events
Impact
A malicious server can craft events with a depth outside the integer range allowed by Canonical JSON. When such an event is received by Synapse version up to 1.127.0, it prevents it from federating with other servers. The vulnerability has been exploited in the wild.
Patches
Fixed in Synapse v1.127.1.
Workarounds
Closed federation environments of trusted servers or non-federating installations are not affected.
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
- Record
PYSEC-2026-1614- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-30355
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
- Record
UBUNTU-CVE-2025-30355- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14939-1 No score
matrix-synapse-1.127.1-1.1 on GA media
These are all security issues fixed in the matrix-synapse-1.127.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14939-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-synapsePyPI |
before 1.127.1 | 1.127.1 |
synapseAlpine:v3.21 |
before 1.127.1-r0 | 1.127.1-r0 |
synapseAlpine:v3.22 |
before 1.127.1-r0 | 1.127.1-r0 |
synapseAlpine:v3.23 |
before 1.127.1-r0 | 1.127.1-r0 |
synapseAlpine:v3.24 |
before 1.127.1-r0 | 1.127.1-r0 |
matrix-synapsePyPI |
before 1.127.1, plus listed versions 0.33.50.33.5.10.33.60.33.6rc10.33.7 Show 45 moreShow less0.33.7rc10.33.7rc20.33.80.33.8rc20.33.90.34.00.34.0.10.34.0rc10.34.0rc20.34.1.10.99.00.99.0rc10.99.0rc20.99.0rc30.99.0rc40.99.10.99.1.10.99.1rc10.99.1rc20.99.20.99.2rc10.99.30.99.3.10.99.3.20.99.3rc10.99.40.99.4rc10.99.50.99.5.10.99.5.20.99.5rc11.0.01.0.0rc11.0.0rc21.0.0rc31.1.01.1.0rc11.1.0rc21.10.01.10.0rc11.10.0rc21.10.0rc31.10.0rc51.10.11.100.0 |
1.127.1 |
matrix-synapseUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.19.2+dfsg-60.24.0+dfsg-10.24.0+dfsg-1ubuntu0.1~esm10.24.0+dfsg-1ubuntu0.1~esm4 |
None known |
matrix-synapseUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.3.0-11.4.0-11.5.0-11.5.1-11.6.0-1 Show 12 moreShow less1.6.1-11.7.0-21.7.1-11.7.2-11.7.3-11.8.0-11.9.0-11.9.1-11.10.0-11.10.0-21.11.0-11.11.0-1ubuntu0.1~esm2 |
None known |
matrix-synapseUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.39.0-11.47.0-21.47.1-11.48.0-11.49.0-1 Show 7 moreShow less1.49.2-11.50.1-11.50.2-11.51.0-11.52.0-11.53.0-11.53.0-1ubuntu0.1~esm2 |
None known |
matrix-synapseUbuntu:24.04:LTS |
All versions, plus listed versions 1.90.0-11.100.0-1ubuntu1 |
None known |
matrix-synapseopenSUSE:Tumbleweed |
before 1.127.1-1.1 | 1.127.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-30355 is a high vulnerability (CVSS 7.1) in Element-hq Synapse, published March 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. Fixed in matrix-synapse 1.127.1.
References
github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6
nvd.nist.gov/vuln/detail/CVE-2025-30355
security.alpinelinux.org/vuln/CVE-2025-30355
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2025-30355
pypi.org/project/matrix-synapse
ubuntu.com/security/CVE-2025-30355
cve.org/CVERecord?id=CVE-2025-30355
lists.opensuse.org/archives/list/[email protected]/thread/BMJS2YEFBSOJRCOH6GFYZZHGJUCSI6ZU
suse.com/security/cve/CVE-2025-30355
Left out here: 384 versions. The JSON record has them.