{"id":"CVE-2022-39374","aliases":["ALPINE-CVE-2022-39374","DEBIAN-CVE-2022-39374","EUVD-2023-0138","GHSA-p9qp-c452-f9r7","PYSEC-2023-66","UBUNTU-CVE-2022-39374","USN-7444-1"],"status":"published","title":"Synapse Denial of service due to incorrect application of event authorization rules during state resolution","description":"Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00941,"percentile":0.61233,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2023-05-24T17:21:33Z","modified":"2026-11-03T07:31:26Z","fixes":[{"ecosystem":"PyPI","package":"matrix-synapse","fixed_in":["1.68.0rc1","1.68.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.18","package":"synapse","fixed_in":["1.70.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"synapse","fixed_in":["1.68.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"synapse","fixed_in":["1.68.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"synapse","fixed_in":["1.68.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"synapse","fixed_in":["1.68.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"synapse","fixed_in":["1.68.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"synapse","fixed_in":["1.68.0-r0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"matrix-synapse","fixed_in":["1.11.0-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"matrix-synapse","fixed_in":["1.53.0-1ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.62.0"},{"fixed":"1.68.0rc1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.62.0"},{"fixed":"1.70.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.62.0"},{"fixed":"1.68.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.62.0"},{"fixed":"1.68.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.62.0"},{"fixed":"1.68.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.62.0"},{"fixed":"1.68.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.62.0"},{"fixed":"1.68.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.62.0"},{"fixed":"1.68.0-r0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.62.0"},{"fixed":"1.68.0rc1"}]}],"versions":["1.62.0","1.63.0","1.63.0rc1","1.63.1","1.64.0","1.64.0rc1","1.64.0rc2","1.65.0","1.65.0rc1","1.65.0rc2","1.66.0","1.66.0rc1","1.66.0rc2","1.67.0","1.67.0rc1"]},{"source":"osv","ecosystem":"PyPI","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.62.0"},{"fixed":"1.68.0"}]}],"versions":["1.62.0","1.63.0","1.63.0rc1","1.63.1","1.64.0","1.64.0rc1","1.64.0rc2","1.65.0","1.65.0rc1","1.65.0rc2","1.66.0","1.66.0rc1","1.66.0rc2","1.67.0","1.67.0rc1","1.68.0rc1","1.68.0rc2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1ubuntu0.1~esm2"}]}],"versions":["1.3.0-1","1.4.0-1","1.5.0-1","1.5.1-1","1.6.0-1","1.6.1-1","1.7.0-2","1.7.1-1","1.7.2-1","1.7.3-1","1.8.0-1","1.9.0-1","1.9.1-1","1.10.0-1","1.10.0-2","1.11.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-1ubuntu0.1~esm2"}]}],"versions":["1.39.0-1","1.47.0-2","1.47.1-1","1.48.0-1","1.49.0-1","1.49.2-1","1.50.1-1","1.50.2-1","1.51.0-1","1.52.0-1","1.53.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.0+dfsg-1ubuntu0.1~esm4"}]}],"versions":["0.19.2+dfsg-6","0.24.0+dfsg-1","0.24.0+dfsg-1ubuntu0.1~esm1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1ubuntu0.1~esm2"}]}],"versions":["1.3.0-1","1.4.0-1","1.5.0-1","1.5.1-1","1.6.0-1","1.6.1-1","1.7.0-2","1.7.1-1","1.7.2-1","1.7.3-1","1.8.0-1","1.9.0-1","1.9.1-1","1.10.0-1","1.10.0-2","1.11.0-1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-1ubuntu0.1~esm2"}]}],"versions":["1.39.0-1","1.47.0-2","1.47.1-1","1.48.0-1","1.49.0-1","1.49.2-1","1.50.1-1","1.50.2-1","1.51.0-1","1.52.0-1","1.53.0-1"],"bundled":8}],"products":[{"vendor":"element-hq","product":"synapse"},{"vendor":"matrix","product":"synapse"},{"vendor":"matrix-org","product":"synapse"}],"references":[{"url":"https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/matrix-org/synapse/pull/13723","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39374","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-66.yaml","tags":["web"]},{"url":"https://github.com/matrix-org/synapse/commit/b73cbb82157d9666e8d667733afebc0d09ed858c","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p9qp-c452-f9r7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-39374","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39374.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-39374","tags":["advisory"]},{"url":"https://github.com/matrix-org/synapse","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-39374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39374","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7444-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-39335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-41335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-42453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-43796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-31208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-53863","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-39374","title":"Synapse Denial of service due to incorrect application of event authorization rules during state resolution","description":"Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0","status":"published","published":"2023-05-26T13:44:44.113Z","modified":"2025-02-13T16:33:00.253Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2023-0138","description":"Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0","status":"published","published":"2023-05-26T13:44:44Z","modified":"2025-02-13T16:33:00Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:52.297177Z"}],"ghsa":[{"id":"GHSA-p9qp-c452-f9r7","title":"Synapse Denial of service due to incorrect application of event authorization rules during state resolution","description":"### Impact\nIf Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected.\n\nSynapse homeservers are affected by this issue if and only if they are joined to rooms which members of untrusted homeservers are joined or invited to. \n\n- Synapse homeservers in rooms available over public federation **are** affected.\n- Synapse homeservers with federation disabled are not affected.\n- Synapse homeservers in a closed federation containing only trusted servers are not affected.\n- Synapse homeservers which are only joined to rooms with federation disabled[^1] are not affected.\n\n### Patches\nAdministrators of homeservers with federation enabled are advised to upgrade to 1.68.0 or higher.\n\n### Workarounds\n * Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`). from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0\n\n### References\n- https://github.com/matrix-org/synapse/pull/13723\n\n[^1]: See `m.federate` in the [`m.room.create` definition](https://spec.matrix.org/v1.4/client-server-api/#mroomcreate).\n\n### For more information\n\nIf you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).","status":"published","published":"2023-05-24T17:21:33Z","modified":"2024-09-30T20:25:26Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:07.852618Z"}],"nvd":[{"id":"CVE-2022-39374","description":"Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0","status":"published","published":"2023-05-26T14:15:10.257Z","modified":"2026-06-17T04:58:14.383Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:38.721429Z"}],"osv":[{"id":"ALPINE-CVE-2022-39374","description":"Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0","status":"published","published":"2023-05-26T14:15:10.257Z","modified":"2026-11-03T07:31:26.105608459Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"CVE-2022-39374","title":"Synapse Denial of service due to incorrect application of event authorization rules during state resolution","description":"Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0","status":"published","published":"2023-05-26T13:44:44.113Z","modified":"2026-10-28T02:30:46.697962388Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"DEBIAN-CVE-2022-39374","description":"Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0","status":"withdrawn","published":"2023-05-26T14:15:10.257Z","modified":"2026-08-11T20:49:48.9568927Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:37.555261Z"},{"id":"GHSA-p9qp-c452-f9r7","title":"Synapse Denial of service due to incorrect application of event authorization rules during state resolution","description":"### Impact\nIf Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected.\n\nSynapse homeservers are affected by this issue if and only if they are joined to rooms which members of untrusted homeservers are joined or invited to. \n\n- Synapse homeservers in rooms available over public federation **are** affected.\n- Synapse homeservers with federation disabled are not affected.\n- Synapse homeservers in a closed federation containing only trusted servers are not affected.\n- Synapse homeservers which are only joined to rooms with federation disabled[^1] are not affected.\n\n### Patches\nAdministrators of homeservers with federation enabled are advised to upgrade to 1.68.0 or higher.\n\n### Workarounds\n * Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`). from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0\n\n### References\n- https://github.com/matrix-org/synapse/pull/13723\n\n[^1]: See `m.federate` in the [`m.room.create` definition](https://spec.matrix.org/v1.4/client-server-api/#mroomcreate).\n\n### For more information\n\nIf you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).","status":"published","published":"2023-05-24T17:21:33Z","modified":"2024-09-30T20:38:17.872853Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"UBUNTU-CVE-2022-39374","description":"Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0","status":"published","published":"2023-05-26T14:15:00Z","modified":"2026-02-04T03:20:41.08525Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"PYSEC-2023-66","description":"Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0\n\n","status":"published","published":"2023-05-26T14:15:00Z","modified":"2023-11-08T04:10:20.163376Z","updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"USN-7444-1","title":"matrix-synapse vulnerabilities","description":"It was discovered that Synapse network policies could be bypassed via\nspecially crafted URLs. An attacker could possibly use this issue to\nbypass authentication mechanisms. (CVE-2023-32683)\n\nIt was discovered that Synapse exposed cached device information. An\nattacker could possibly use this issue to gain access to sensitive\ninformation. (CVE-2023-43796)\n\nIt was discovered that Synapse could be tricked into rejecting state\nchanges in rooms. An attacker could possibly use this issue to cause\nSynapse to stop functioning properly, resulting in a denial of service.\nThis issue was only fixed in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2022-39374)\n\nIt was discovered that Synapse stored user credentials in a server's\ndatabase temporarily. An attacker could possibly use this issue to\ngain access to sensitive information. This issue was only fixed in\nUbuntu 22.04 LTS. (CVE-2023-41335)\n\nIt was discovered that Synapse could incorrectly respond to server\nauthorization events. An attacker could possibly use this issue to\nbypass authentication mechanisms. This issue was only fixed in Ubuntu\n22.04 LTS. (CVE-2022-39335)\n\nIt was discovered that Synapse could be manipulated to mark messages\nas read when they had not been viewed. An attacker could possibly use\nthis issue to perform repudiation-based attacks. This issue was only\nfixed in Ubuntu 22.04 LTS. (CVE-2023-42453)\n\nIt was discovered that Synapse had several memory-related issues. An\nattacker could possibly use this issue to cause Synapse to crash,\nresulting in a denial of service. This issue was only fixed in Ubuntu\n22.04 LTS. (CVE-2024-31208)\n\nIt was discovered that Synapse could run external tools due to a\nunchecked thumbnail rendering routine. An attacker could possibly use\nthis issue to cause Synapse to crash, resulting in a denial of service,\nor execute arbitrary code. This issue was only fixed in Ubuntu\n22.04 LTS. (CVE-2024-53863)\n","status":"published","published":"2025-04-22T17:24:26Z","modified":"2026-04-27T18:02:27.885669037Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}