CVE-2024-52815: Synapse allows a a malformed invite to break the invitee's `/sync`

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-03 · updated 2026-06-17
Weakness: CWE-20

Description

Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.

Affected products

matrix-org synapse: before 1.120.1 — fixed in 1.120.1

How to fix

Upgrade to a fixed version: matrix-org synapse 1.120.1. Check the vendor advisory for mitigations.

References

https://github.com/element-hq/synapse/security/advisories/GHSA-f3r3-h2mq-hx2h

Get alerted when CVE-2024-52815 or the next vulnerability affects your stack