CVE-2025-66622CWE-755

CVE-2025-66622

High · published December 9, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-755 · Improper Handling of Exceptional Conditions
Published
2025-12-09T21:18Z
Affected products (1)
ProductVersionsFixed in
matrix/matrix-rust-sdk< 0.16.00.16.0
References (4)
https://github.com/matrix-org/matrix-rust-sdk/commit/4ea0418abefab2aa93f8851a4d39c723e703e6b0 · [email protected]https://github.com/matrix-org/matrix-rust-sdk/pull/5924 · [email protected]https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3 · [email protected]https://rustsec.org/advisories/RUSTSEC-2025-0135.html · [email protected]
EPSS history
Timeline
  • 09 DEC 02:07Z
    matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
    cvelistv5