Homepage
About Snyk

matrix-synapse@1.95.0 vulnerabilities

Homeserver for the Matrix decentralised comms protocol

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the matrix-synapse package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Allocation of Resources Without Limits or Throttling

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a weakness in how the auth chain cover index is calculated. An attacker can induce high CPU consumption and accumulate excessive data in the database by dispatching specially crafted events.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade matrix-synapse to version 1.105.1 or higher.

[,1.105.1)
  • M
Information Exposure

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Information Exposure. An attacker can query remote users' device information which can be used to enumerate the remote users known to a homeserver.

How to fix Information Exposure?

Upgrade matrix-synapse to version 1.95.1 or higher.

[,1.95.1)
Go back to all versions of this package