Element-hq Synapse vulnerabilities

• element synapse Synapse pagination denial of service CVE-2026-45076 Fix available 5.1 MediumMay 14, 2026
• element synapse Synapse CPU starvation (Denial of Service) CVE-2026-45078 Fix available 6.8 MediumMay 14, 2026
• element-hq synapse Synapse: Invalid device keys degrade federation functionality CVE-2025-61672 Fix available 5.3 MediumOctober 7, 2025
• element-hq synapse Synapse vulnerable to federation denial of service via malformed events CVE-2025-30355 Fix available 7.1 HighMarch 27, 2025
• element-hq synapse Synapse unauthenticated writes to the media repository allow planting of problematic content CVE-2024-37303 Fix available 5.3 MediumDecember 3, 2024
• element-hq synapse Synapse denial of service through media disk space consumption CVE-2024-37302 Fix available 7.5 HighDecember 3, 2024
• element-hq synapse Synapse allows unsupported content types to lead to memory exhaustion CVE-2024-52805 Fix available 8.2 HighDecember 3, 2024
• element-hq synapse Synapse allows a a malformed invite to break the invitee's `/sync` CVE-2024-52815 Fix available 8.7 HighDecember 3, 2024
• element-hq synapse Synapse Matrix has a partial room state leak via Sliding Sync CVE-2024-53867 Fix available 4.3 MediumDecember 3, 2024
• element-hq synapse Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVE-2024-53863 Fix available 8.2 HighDecember 3, 2024
• element-hq synapse, fedoraproject fedora +1 more Synapse's V2 state resolution weakness allows DoS from remote room members CVE-2024-31208 Fix available 6.5 MediumApril 23, 2024
• element-hq synapse, fedoraproject fedora +1 more Synapse vulnerable to leak of remote user device information CVE-2023-43796 Fix available 5.3 MediumOctober 31, 2023
• element-hq synapse, fedoraproject fedora +1 more matrix-synapse vulnerable to denial of service due to malicious server ACL events CVE-2023-45129 Fix available 4.9 MediumOctober 10, 2023
• element-hq synapse, fedoraproject fedora +1 more Improper validation of receipts allows forged read receipts in matrix synapse CVE-2023-42453 Fix available 3.1 LowSeptember 26, 2023
• element-hq synapse, fedoraproject fedora +1 more Temporary storage of plaintext passwords during password changes in matrix synapse CVE-2023-41335 Fix available 3.7 LowSeptember 26, 2023
• element-hq synapse URL deny list bypass via oEmbed and image URLs when generating previews in Synapse CVE-2023-32683 Fix available 3.5 LowJune 6, 2023
• element-hq synapse Improper checks for deactivated users during login in synapse CVE-2023-32682 Fix available 5.4 MediumJune 6, 2023
• element-hq synapse Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVE-2023-32323 Fix available 5.0 MediumMay 24, 2023
• element-hq synapse Synapse Denial of service due to incorrect application of event authorization rules during state resolution CVE-2022-39374 Fix available 6.5 MediumMay 24, 2023
• element-hq synapse Synapse does not apply enough checks to servers requesting auth events of events in a room CVE-2022-39335 Fix available 5.0 MediumMay 24, 2023
• element-hq synapse Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules CVE-2022-31152 Fix available 6.4 MediumAugust 31, 2022
• element-hq synapse, fedoraproject fedora +1 more URL previews can crash Synapse media repositories or Synapse monoliths CVE-2022-31052 Fix available 6.5 MediumJune 28, 2022
• element-hq synapse Uncontrolled Resource Consumption in Matrix Synapse CVE-2022-41952 Fix available 6.5 MediumApril 1, 2022
• element-hq synapse, fedoraproject fedora +1 more Path traversal in Matrix Synapse CVE-2021-41281 Fix available 7.5 HighNovember 23, 2021
• element-hq synapse, fedoraproject fedora +1 more Improper authorisation of /members discloses room membership to non-members CVE-2021-39164 Fix available 3.1 LowAugust 31, 2021
• element-hq synapse, fedoraproject fedora +1 more Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. CVE-2021-39163 Fix available 3.1 LowAugust 31, 2021
• element-hq synapse, fedoraproject fedora +1 more Denial of service in Matrix Synapse CVE-2021-29471 Fix available 3.7 LowMay 11, 2021
• element-hq synapse, fedoraproject fedora +1 more Open redirect via transitional IPv6 addresses on dual-stack networks CVE-2021-21392 Fix available 6.3 MediumApril 12, 2021
• element-hq synapse, fedoraproject fedora +1 more Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints CVE-2021-21393 Fix available 5.3 MediumApril 12, 2021
• element-hq synapse, fedoraproject fedora +1 more Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints CVE-2021-21394 Fix available 5.3 MediumApril 12, 2021
• element-hq synapse, fedoraproject fedora +1 more HTML injection in email and account expiry notifications CVE-2021-21333 Fix available 6.1 MediumMarch 26, 2021
• element-hq synapse, fedoraproject fedora +1 more Cross-site scripting (XSS) vulnerability in the password reset endpoint CVE-2021-21332 Fix available 6.9 MediumMarch 26, 2021
• element-hq synapse, fedoraproject fedora +1 more Open redirects on some federation and push requests CVE-2021-21273 Fix available 3.1 LowFebruary 26, 2021
• element-hq synapse, fedoraproject fedora +1 more Denial of service attack via .well-known lookups CVE-2021-21274 Fix available 4.3 MediumFebruary 26, 2021
• element-hq synapse, fedoraproject fedora +1 more Denial of service attack via incorrect parameters to federation APIs CVE-2020-26257 Fix available 6.5 MediumDecember 9, 2020