py-matrix-synapse -- federation denial of service via malformed events

2025-03-26 · CVE-2025-30355 · VuXML entry

element-hq/synapse developers report: A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild.

Affected versions

py38-matrix-synapse, py39-matrix-synapse, py310-matrix-synapse, py311-matrix-synapse < 1.127.1

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.

System	Port	Version	State	Fixed
DragonFly	net-im/py-matrix-synapse	1.127.1	fixed

System

Port

Version

State

Fixed

DragonFly

net-im/py-matrix-synapse

1.127.1

fixed