Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5epss 1.0%
exploitation probability
1.0%top 41% of all CVEs
observed exploitation
nono source reports it
In short
A malicious user on a Matrix Synapse server can send specially crafted invitations to disable communication between that server and another server. This breaks federation, preventing legitimate message exchange between the two servers.
Technical detail
A local attacker with state event creation permissions can craft oversized `invite_room_state` fields in room invitations to trigger denial-of-service conditions that disable outbound federation to a targeted homeserver. Pre-conditions include federation enablement and attacker permissions; mitigation requires upgrading to Synapse 1.74+ to enforce size limits on invite event payloads.
Summary generated and translated by AI from the official description.
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Affected products
matrix-org · synapseReferences
https://github.com/matrix-org/synapse/issues/14492https://github.com/matrix-org/synapse/pull/14642https://github.com/matrix-org/synapse/security/advisories/GHSA-f3wc-3vxv-xmvrhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/