{"id":"CVE-2022-39200","aliases":["ALPINE-CVE-2022-39200","EUVD-2022-6895","GHSA-pfw4-xjgm-267c","GO-2022-0989"],"status":"published","title":"Signature checks not applied to some retrieved missing events","description":"Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00369,"percentile":0.30979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2022-09-12T20:10:09Z","modified":"2026-11-03T07:30:40Z","fixes":[{"ecosystem":"Go","package":"github.com/matrix-org/dendrite","fixed_in":["0.9.8"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"dendrite","fixed_in":["0.9.8-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/matrix-org/dendrite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"dendrite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/matrix-org/dendrite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/matrix-org/dendrite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.8"}]}]}],"products":[{"vendor":"matrix","product":"dendrite"},{"vendor":"matrix-org","product":"dendrite"}],"references":[{"url":"https://github.com/matrix-org/dendrite/security/advisories/GHSA-pfw4-xjgm-267c","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/matrix-org/dendrite/commit/2792d0490f3771488bad346981b8c26479a872c3","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39200","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pfw4-xjgm-267c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-39200","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39200.json","tags":["advisory"]},{"url":"https://github.com/matrix-org/dendrite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-39200","title":"Signature checks not applied to some retrieved missing events","description":"Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-09-12T20:10:09Z","modified":"2025-04-23T17:12:01.868Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:34:39.559326Z"}],"euvd":[{"id":"EUVD-2022-6895","description":"Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-09-12T20:10:09Z","modified":"2025-04-23T17:12:01Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:10.906327Z"}],"ghsa":[{"id":"GHSA-pfw4-xjgm-267c","title":"Dendrite signature checks not applied to some retrieved missing events","description":"### Impact\n\nEvents retrieved from a remote homeserver using `/get_missing_events` did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint.\n\nNote that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified.\n\nHomeservers that have federation disabled are not vulnerable.\n\n### Patches\n\nThe problem has been fixed in Dendrite 0.9.8.\n\n### Workarounds\n\nThere are no workarounds.\n\n### Special thanks\n\nTulir Asokan, who spotted the issue originally.","status":"published","published":"2022-09-15T03:28:01Z","modified":"2023-02-02T05:10:07Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:36:41.247728Z"}],"nvd":[{"id":"CVE-2022-39200","description":"Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-09-12T20:15:12.96Z","modified":"2026-06-17T04:57:54.137Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"ALPINE-CVE-2022-39200","description":"Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-09-12T20:15:12.96Z","modified":"2026-11-03T07:30:40.006631199Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-39200","title":"Signature checks not applied to some retrieved missing events","description":"Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-09-12T20:10:09Z","modified":"2026-10-28T02:30:44.52516981Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"GHSA-pfw4-xjgm-267c","title":"Dendrite signature checks not applied to some retrieved missing events","description":"### Impact\n\nEvents retrieved from a remote homeserver using `/get_missing_events` did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint.\n\nNote that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified.\n\nHomeservers that have federation disabled are not vulnerable.\n\n### Patches\n\nThe problem has been fixed in Dendrite 0.9.8.\n\n### Workarounds\n\nThere are no workarounds.\n\n### Special thanks\n\nTulir Asokan, who spotted the issue originally.","status":"published","published":"2022-09-15T03:28:01Z","modified":"2024-08-21T16:28:42.702294Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"GO-2022-0989","title":"Dendrite signature checks not applied to some retrieved missing events in github.com/matrix-org/dendrite","description":"Dendrite signature checks not applied to some retrieved missing events in github.com/matrix-org/dendrite","status":"published","published":"2024-08-21T16:03:24Z","modified":"2026-03-03T04:52:33.391464Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}