conduit -- e2ee signing keys vulnerability

2026-11-11 · VuXML entry

Conduit team reports: Fixes a vulnerability where E2EE signing keys could be accepted from servers other than the one the user belongs to. It is recommended you upgrade ASAP.

Affected versions

• matrix-conduit < 0.10.16

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.