CVE-2019-11842: Matrix Synapse - Mishandling of Random Number Generation
Summary
CVE-2019-11842: An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Affects matrix-synapse versions < 0.99.3.1. Fixed in 0.99.3.1. How to fix ↓
Also tracked for
- matrix-sydent · PyPI
- matrix-sydent · PyPI
- matrix-synapse · Debian:13
The same CVE-2019-11842 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix Synapse is an open-source messaging server that enables secure communication and collaboration. It provides a decentralized architecture for real-time communication and supports end-to-end encryption. The vulnerability identified as CVE-2019-11842 affects versions prior to 0.99.3.1 of Matrix Synapse. This vulnerability is related to the mishandling of random number generation, which can lead to the predictability of authentication tokens and random IDs.
Vulnerability Detail
The vulnerability arises from the incorrect implementation of random number generation in Matrix Sydent and Synapse. This flaw allows attackers to predict authentication tokens or random IDs, compromising the security of the system. By exploiting this vulnerability, an attacker could gain unauthorized access to sensitive information or perform malicious actions within the affected system. It is crucial to address this vulnerability promptly to prevent potential security breaches.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.99.3.1
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==0.99.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Matrix Synapse, identified as CVE-2019-11842, involves the mishandling of random number generation. This flaw can lead to the predictability of authentication tokens and random IDs, potentially compromising the security of the system. It is crucial to update Matrix Synapse to version 0.99.3.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
Matrix Synapse is an open-source messaging server that enables secure communication and collaboration.
This vulnerability allows attackers to predict authentication tokens or random IDs, potentially compromising the security of the system.
Versions prior to 0.99.3.1 of Matrix Synapse are affected by this vulnerability.
To fix this vulnerability, update Matrix Synapse to version 0.99.3.1 or later.
For more information about this vulnerability, refer to the official advisory provided by the Matrix Synapse project.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
