CVE-2025-30355: Matrix Synapse Denial of Service via Malformed Events
Summary
CVE-2025-30355: Synapse vulnerable to federation denial of service via malformed events. Affects matrix-synapse versions < 1.127.1. Fixed in 1.127.1. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2025-30355 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix Synapse is an open-source server implementation of the Matrix protocol, enabling real-time communication and federation between different servers. It allows users to communicate across various platforms while maintaining control over their data. However, Synapse versions up to 1.127.0 are vulnerable to a denial of service attack through malformed events, which can disrupt federation with other servers.
Vulnerability Detail
The vulnerability arises from the ability of a malicious server to craft specific malformed events that, when received by Synapse, can prevent it from federating with other servers. This issue has been actively exploited in the wild, posing a significant risk to the integrity and availability of services relying on Synapse for communication. The vulnerability is classified under CWE-20, indicating improper input validation.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.127.1
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.127.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are operating in a closed federation environment with trusted servers or are using a non-federating installation, you are not affected by this vulnerability. It is advisable to maintain such configurations until the package can be updated.
Conclusion
In summary, CVE-2025-30355 poses a significant risk to Matrix Synapse installations up to version 1.127.0, allowing denial of service attacks through malformed events. It is crucial to update to version 1.127.1 or later to mitigate this risk. For those unable to update immediately, utilizing a closed federation environment is recommended.
See every vulnerability recorded for matrix-synapse →
FAQ
The impact includes the potential for a malicious server to disrupt federation capabilities of Synapse, affecting communication between servers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Synapse versions up to 1.127.0 are affected by this vulnerability.
If immediate updating is not possible, consider using a closed federation environment or a non-federating installation as a temporary workaround.
The CVSS score for this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
