CVE-2025-30355CWE-20

Synapse vulnerable to federation denial of service via malformed events

High · published March 27, 2025

CVSS v3.1
7.1
EPSS
1%
Percentile
68.6
In the wild
Unconfirmed
What it is

Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.01226 · 68.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-03-27T00:59Z
EPSS history
Timeline
  • 27 MAR 00:59Z
    Synapse vulnerable to federation denial of service via malformed events
    cvelistv5