{"id":"CVE-2024-52594","aliases":["ALPINE-CVE-2024-52594","EUVD-2025-0090","GHSA-4ff6-858j-r822","GO-2025-3396","SUSE-SU-2025:0297-1","openSUSE-SU-2025:14704-1"],"status":"published","title":"Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib","description":"Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00354,"percentile":0.29528,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2025-01-16T18:57:29Z","modified":"2026-11-03T06:32:50Z","fixes":[{"ecosystem":"Go","package":"github.com/matrix-org/gomatrixserverlib","fixed_in":["0.0.0-20250116181547-c4f1e01eab0d"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.21","package":"dendrite","fixed_in":["0.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dendrite","fixed_in":["0.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dendrite","fixed_in":["0.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dendrite","fixed_in":["0.14.1-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/matrix-org/gomatrixserverlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.0-20250106190028-bf86bc98b879"},{"fixed":"0.0.0-20250116181547-c4f1e01eab0d"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dendrite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dendrite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dendrite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dendrite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/matrix-org/gomatrixserverlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20250116181547-c4f1e01eab0d"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/matrix-org/gomatrixserverlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20250116181547-c4f1e01eab0d"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-150000.1.29.1"}]}],"bundled":33},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-150000.1.29.1"}]}],"bundled":33},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250117T214834-1.1"}]}],"bundled":10}],"products":[{"vendor":"matrix-org","product":"gomatrixserverlib"}],"references":[{"url":"https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/matrix-org/gomatrixserverlib/commit/c4f1e01eab0dd435709ad15463ed38a079ad6128","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52594","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3396","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4ff6-858j-r822"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-52594","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52594.json","tags":["advisory"]},{"url":"https://github.com/matrix-org/gomatrixserverlib","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250297-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24355","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-52594","title":"Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib","description":"Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.","status":"published","published":"2025-01-16T18:57:29.333Z","modified":"2025-02-12T20:31:20.951Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:03.661584Z"}],"euvd":[{"id":"EUVD-2025-0090","description":"Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.","status":"published","published":"2025-01-16T18:57:29Z","modified":"2025-02-12T20:31:20Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:56.514594Z"}],"ghsa":[{"id":"GHSA-4ff6-858j-r822","title":"Gomatrixserverlib Server-Side Request Forgery (SSRF) on redirects and federation","description":"### Impact\nGomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions.\n\n### Patches\n\nc4f1e01eab0dd435709ad15463ed38a079ad6128 fixes this issue.\n\n\n### Workarounds\nUse a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.\n\n### References\nN/A\n","status":"published","published":"2025-01-16T23:08:32Z","modified":"2025-01-17T15:41:23Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:38:27.067633Z"}],"nvd":[{"id":"CVE-2024-52594","description":"Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.","status":"published","published":"2025-01-16T19:15:28.48Z","modified":"2026-06-17T08:07:30.903Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:42.895329Z"}],"osv":[{"id":"ALPINE-CVE-2024-52594","description":"Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.","status":"published","published":"2025-01-16T19:15:28.48Z","modified":"2026-11-03T06:32:50.184398977Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2024-52594","title":"Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib","description":"Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.","status":"published","published":"2025-01-16T18:57:29.333Z","modified":"2026-10-28T02:30:55.24812235Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"GHSA-4ff6-858j-r822","title":"Gomatrixserverlib Server-Side Request Forgery (SSRF) on redirects and federation","description":"### Impact\nGomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions.\n\n### Patches\n\nc4f1e01eab0dd435709ad15463ed38a079ad6128 fixes this issue.\n\n\n### Workarounds\nUse a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.\n\n### References\nN/A\n","status":"published","published":"2025-01-16T23:08:32Z","modified":"2025-01-17T15:41:23Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"GO-2025-3396","title":"Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib","description":"Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib","status":"published","published":"2025-01-16T22:53:23Z","modified":"2025-01-16T23:27:18.600557Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14704-1","title":"govulncheck-vulndb-0.0.20250117T214834-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250117T214834-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-28T00:00:00Z","modified":"2026-02-04T02:37:02.613621Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0297-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx\n  * GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h\n  * GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q\n  * GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6\n  * GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7\n  * GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356\n  * GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76\n  * GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6\n  * GO-2025-3422 CVE-2025-24354\n\n- Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3372 CVE-2024-45339\n  * GO-2025-3373 CVE-2024-45341\n  * GO-2025-3383 CVE-2024-45340\n  * GO-2025-3420 CVE-2024-45336\n  * GO-2025-3421 CVE-2025-22865\n\n- Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g\n  * GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972\n  * GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6\n  * GO-2025-3396 CVE-2024-52594\n  * GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg\n  * GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj\n  * GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv\n  * GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r\n  * GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf\n  * GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997\n\n- Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v\n  * GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp\n  * GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv\n  * GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7\n  * GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9\n\n- Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82\n  * GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm\n  * GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm\n  * GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79\n","status":"published","published":"2025-01-30T14:03:37Z","modified":"2026-02-05T11:21:44.836869Z","updated_at":"2026-11-02T15:53:57.111474Z"}]}}