CVE-2019-18835

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-08 · updated 2026-06-17
Weakness: CWE-345

Description

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.

Affected products

matrix-org synapse: before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: matrix-org synapse 1.5.0. Check the vendor advisory for mitigations.

References

https://github.com/matrix-org/synapse/pull/6262
https://github.com/matrix-org/synapse/releases/tag/v1.5.0
https://github.com/matrix-org/synapse/pull/6262
https://github.com/matrix-org/synapse/releases/tag/v1.5.0

Get alerted when CVE-2019-18835 or the next vulnerability affects your stack