CVE-2024-52805CWE-770

Synapse allows unsupported content types to lead to memory exhaustion

High · published December 3, 2024

CVSS v4.0
8.2
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00739 · 54.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-12-03T17:01Z
EPSS history
Timeline
  • 03 DEC 17:01Z
    Synapse allows unsupported content types to lead to memory exhaustion
    cvelistv5