CVE-2022-41952: Uncontrolled Resource Consumption in Matrix Synapse
Summary
CVE-2022-41952: Uncontrolled Resource Consumption in Matrix Synapse. Affects matrix-synapse versions < 1.53.0. Fixed in 1.53.0. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2022-41952 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Matrix Synapse is an open-source server software that implements the Matrix protocol, allowing users to communicate and collaborate in real-time. It provides features such as end-to-end encryption, room management, and message synchronization across multiple devices. However, a vulnerability has been discovered in versions before 1.53.0 that can lead to uncontrolled resource consumption.
Vulnerability Detail
The vulnerability in Matrix Synapse arises from the URL preview functionality, which attempts to generate previews for media stream URLs without properly limiting connection time. This can result in long-lived connections towards streaming media servers, causing excessive traffic and connections if the stream URL is shared in a large room with many Synapse instances. The issue can be exploited by an attacker to consume server resources and potentially disrupt the availability of the service.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.53.0
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.53.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, a workaround is to disable the URL preview functionality by setting 'url_preview_enabled: false' in the Synapse configuration file. This will prevent the vulnerability from being exploited, but it also disables the URL preview feature for all media stream URLs.
Conclusion
The vulnerability in Matrix Synapse can be mitigated by upgrading to version 1.53.0 or later, which includes necessary fixes and improvements. If immediate upgrading is not possible, disabling the URL preview functionality can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
Matrix Synapse is an open-source server software that implements the Matrix protocol for real-time communication and collaboration.
The vulnerability can lead to uncontrolled resource consumption, causing excessive traffic and connections towards streaming media servers, potentially impacting the availability of the service.
Upgrade to version 1.53.0 or later of Matrix Synapse, which includes a timeout mechanism and an allow list for content types. This will fully resolve the issue.
Yes, you can disable the URL preview functionality by setting 'url_preview_enabled: false' in the Synapse configuration file. However, this will disable the URL preview feature for all media stream URLs.
The risk depends on the specific deployment and usage of Matrix Synapse. If the URL preview functionality is enabled and media stream URLs are shared in large rooms, there is a higher risk of resource consumption and potential service disruption.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
