Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

synapse — Vulnerabilities & Security Advisories 35

All 35 CVE vulnerabilities found in synapse, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities associated with the Synapse product line, focusing on software weaknesses and tagged under the Synapse vendor identifier. The collection encompasses a wide spectrum of flaws including memory corruption, authentication bypasses, and logic errors discovered between the initial public release and the current stable version. Visitors can utilize this resource to track the vendor's official security advisories over time, analyze the prevalence and impact of specific weakness classes within the application architecture, or review the complete historical vulnerability record for the product. The data presented here is derived from public disclosures, security bulletins, and verified exploit reports to provide a comprehensive view of the security landscape surrounding Synapse. Users seeking to assess risk, plan remediation strategies, or understand the evolution of security issues in this software will find the chronological listing and detailed categorization essential for their analysis. All entries are curated to ensure accuracy and relevance, offering a centralized reference point for security professionals, developers, and system administrators managing Synapse deployments. This aggregation supports proactive defense by highlighting patterns in past incidents and facilitating informed decision-making regarding patch management and system hardening efforts.

Vendor: matrix-org

CVE ID Title CVSS Severity Published
CVE-2026-45078 Synapse CPU starvation (Denial of Service) CWE-770 - - 2026-05-28
CVE-2026-45076 Synapse pagination denial of service CWE-20 - - 2026-05-28
CVE-2025-61672 Synapse: Invalid device keys degrade federation functionality CWE-1287 6.5AI Medium AI 2025-10-08
CVE-2025-30355 Synapse vulnerable to federation denial of service via malformed events CWE-20 7.1 High 2025-03-27
CVE-2024-37303 Synapse unauthenticated writes to the media repository allow planting of problematic content CWE-306 5.3 Medium 2024-12-03
CVE-2024-37302 Synapse denial of service through media disk space consumption CWE-770 7.5 High 2024-12-03
CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion CWE-770 7.5 - 2024-12-03
CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync` CWE-20 - - 2024-12-03
CVE-2024-53867 Synapse Matrix has a partial room state leak via Sliding Sync CWE-497 4.3 Medium 2024-12-03
CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CWE-434 6.5 - 2024-12-03
CVE-2024-31208 Synapse's V2 state resolution weakness allows DoS from remote room members CWE-770 6.5 Medium 2024-04-23
CVE-2023-43796 Synapse vulnerable to leak of remote user device information CWE-200 5.3 Medium 2023-10-31
CVE-2023-45129 matrix-synapse vulnerable to denial of service due to malicious server ACL events CWE-770 4.9 Medium 2023-10-10
CVE-2023-41335 Temporary storage of plaintext passwords during password changes in matrix synapse CWE-312 3.7 Low 2023-09-26
CVE-2023-42453 Improper validation of receipts allows forged read receipts in matrix synapse CWE-285 3.1 Low 2023-09-26
CVE-2023-32683 URL deny list bypass via oEmbed and image URLs when generating previews in Synapse CWE-863 3.5 Low 2023-06-06
CVE-2023-32682 Improper checks for deactivated users during login in synapse CWE-287 5.4 Medium 2023-06-06
CVE-2022-39374 Synapse Denial of service due to incorrect application of event authorization rules during state resolution CWE-400 5.3 - 2023-05-26
CVE-2022-39335 Synapse does not apply enough checks to servers requesting auth events of events in a room CWE-200 5.0 Medium 2023-05-26
CVE-2023-32323 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CWE-20 5.0 Medium 2023-05-26
CVE-2022-41952 Uncontrolled Resource Consumption in Matrix Synapse CWE-400 6.5 Medium 2022-11-22
CVE-2022-31152 Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules CWE-703 6.4 Medium 2022-09-02
CVE-2022-31052 URL previews can crash Synapse media repositories or Synapse monoliths CWE-674 6.5 Medium 2022-06-28
CVE-2021-41281 Path traversal in Matrix Synapse CWE-22 7.5 High 2021-11-23
CVE-2021-39164 Improper authorisation of /members discloses room membership to non-members CWE-200 3.1 Low 2021-08-31
CVE-2021-39163 Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. CWE-200 3.1 Low 2021-08-31
CVE-2021-29471 Denial of service in Matrix Synapse CWE-400 3.7 Low 2021-05-11
CVE-2021-21392 Open redirect via transitional IPv6 addresses on dual-stack networks CWE-601 6.3 Medium 2021-04-12
CVE-2021-21393 Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints CWE-20 5.3 Medium 2021-04-12
CVE-2021-21394 Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints CWE-20 5.3 Medium 2021-04-12

All 35 known CVE vulnerabilities affecting synapse with full Chinese analysis, references, and POCs where available.