CVE-2020-26257: Matrix Synapse - Malformed Events Injection
Summary
CVE-2020-26257: Matrix is an ecosystem for open federated Instant Messaging and VoIP. Affects matrix-synapse across 2 version ranges.
< 1.23.1
< 3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b
Fixed in 3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2020-26257 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Matrix is an open federated Instant Messaging and VoIP ecosystem. Synapse is a reference "homeserver" implementation of Matrix. It allows users to communicate with each other across different servers. The vulnerability in question arises from a flaw in the implementation of Synapse, where a malicious or poorly-implemented homeserver can inject malformed events into a room by manipulating the room ID in certain requests. This vulnerability affects any server that accepts federation requests from untrusted servers.
Vulnerability Detail
The vulnerability allows an attacker to inject malformed events into a room by specifying a different room ID in the path of certain requests, such as /send_join, /send_leave, /invite, or /exchange_third_party_invite. This can lead to a denial of service (DoS) situation, where future events will not be correctly sent to other servers over federation. The impact of this vulnerability is a disruption in the communication between servers, potentially affecting the availability and reliability of the Matrix ecosystem. The vulnerability is present in the Matrix Synapse reference implementation prior to version 1.23.1.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, homeserver administrators can limit access to the federation API to trusted servers. This can be achieved by configuring a federation domain whitelist, which specifies the trusted servers that are allowed to communicate with the homeserver. By restricting federation requests to trusted sources, the risk of receiving malicious or malformed events is mitigated.
Conclusion
The vulnerability in Matrix Synapse allows for the injection of malformed events into a room, potentially leading to a denial of service situation. To mitigate this vulnerability, it is crucial to update to version 1.23.1 or later. Additionally, limiting access to the federation API to trusted servers through a domain whitelist can provide temporary protection. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
Matrix Synapse is a reference implementation of a Matrix homeserver. It allows users to communicate with each other across different servers in the Matrix ecosystem.
The vulnerability allows for the injection of malformed events into a room, leading to a denial of service situation where future events are not correctly sent to other servers over federation. This can disrupt communication between servers in the Matrix ecosystem.
The vulnerability is present in Matrix Synapse versions prior to 1.23.1. Homeserver administrators should ensure they are running version 1.23.1 or later to mitigate the vulnerability.
To fix this vulnerability, update your Matrix Synapse implementation to version 1.23.1 or later. Follow the upgrade instructions provided by the Matrix project.
Yes, as a temporary workaround, you can limit access to the federation API to trusted servers by configuring a federation domain whitelist. This restricts federation requests to trusted sources and reduces the risk of receiving malicious or malformed events.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
