What’s Vulnerable › Vulnerabilities

CVE-2022-39374: Synapse Denial of service due to incorrect application of event authorization rules during state resolution

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-26 · updated 2026-06-17
• Weakness: CWE-400

Description

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0

Affected products

• matrix-org synapse: from 1.62.0 before 1.68.0 — fixed in 1.68.0

How to fix

Upgrade to a fixed version: matrix-org synapse 1.68.0. Check the vendor advisory for mitigations.

References

• https://github.com/matrix-org/synapse/pull/13723
• https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/
• https://github.com/matrix-org/synapse/pull/13723
• https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/

Get alerted when CVE-2022-39374 or the next vulnerability affects your stack