CVE-2020-26890: Denial of Service Attack in matrix-synapse due to Invalid JSON
Summary
CVE-2020-26890: Denial of service attack due to invalid JSON. Affects matrix-synapse versions < 1.20.0. Fixed in 1.20.0. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2020-26890 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-synapse is a package available on PyPI that serves as a reference implementation of the Matrix protocol, which enables secure and decentralized communication. It is widely used as a server for hosting Matrix homeservers. However, a vulnerability has been discovered in matrix-synapse that allows for a denial of service attack. This vulnerability can be exploited by sending an event containing invalid JSON data to the server, which in turn relays the data to clients. As a result, the clients may crash or hang, leading to a long-lasting impact if the event becomes part of the room state.
Vulnerability Detail
The vulnerability (CVE-2020-26890) in matrix-synapse arises from the acceptance of invalid JSON data. By sending such data as an event to the server, Synapse relays it to clients, potentially causing them to crash or hang. The severity of this vulnerability is rated as HIGH. It is important to note that if an invalid event is accepted by an earlier version of Synapse and becomes part of the room state, upgrading Synapse alone will not fix the issue. In order to mitigate this vulnerability, patches #8106 and #8291 must be applied at a minimum. Additional checks are included in patches #7372 and #8124.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.0
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.20.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to apply the patches mentioned in the 'how_to_fix' section to address the issue effectively.
Conclusion
In conclusion, the matrix-synapse package is vulnerable to a denial of service attack due to the acceptance of invalid JSON data. To address this vulnerability, it is necessary to apply the recommended patches, including #8106, #8291, #7372, and #8124. There are no known workarounds for this issue. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
The impact of this vulnerability is a denial of service attack against Matrix clients. By sending an event with invalid JSON data, the server can relay it to clients, causing them to crash or hang. If the event becomes part of the room state, the impact can be long-lasting.
To fix this vulnerability, at a minimum, patches #8106 and #8291 must be applied. These patches address the handling of invalid JSON data by the server.
Yes, there are additional patches available. Patches #7372 and #8124 include extra checks to further enhance security and prevent the acceptance of invalid JSON data.
No, there are no known workarounds for this vulnerability. It is essential to apply the necessary patches to mitigate the issue.
To prevent the impact of this vulnerability, it is crucial to keep the matrix-synapse package up to date by regularly applying the latest patches and updates. Additionally, it is recommended to follow best practices for secure coding and input validation to minimize the risk of similar vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
