GHSA-hxmp-pqch-c8mm

    Dashboard / Vulnerabilities / GHSA-hxmp-pqch-c8mm

    GHSA-hxmp-pqch-c8mm

    Published: 9 Dec 2020Last Modified: 10 Sept 2026

    Summary: Denial of service attack via incorrect parameters in Matrix Synapse

    Details: ### Impact A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. ### Patches Issue is resolved by https://github.com/matrix-org/synapse/pull/8776. ### Workarounds Homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).

    References: https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm, https://nvd.nist.gov/vuln/detail/CVE-2020-26257, https://github.com/matrix-org/synapse/pull/8776, https://github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b, https://github.com/matrix-org/synapse/blob/develop/CHANGES.md#synapse-1231-2020-12-09, https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2020-236.yaml, https://lists.fedoraproject.org/archives/list/[email protected]/message/DBTIU3ZNBFWZ56V4X7JIAD33V5H2GOMC, https://lists.fedoraproject.org/archives/list/[email protected]/message/QR4MMYZKX5N5GYGH4H5LBUUC5TLAFHI7

    Affected packages

    Package

    Name: matrix-synapse

    Purl: pkg:pypi/matrix-synapse

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.23.1

    Affected versions

    0.33.5
    0.33.5.1
    0.33.6
    0.33.6rc1
    0.33.7
    0.33.7rc1
    0.33.7rc2
    0.33.8
    0.33.8rc2
    0.33.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-hxmp-pqch-c8mm | CVE-DB