CVE-2020-26890: Matrix Synapse JSON Denial of Service Vulnerability
Summary
CVE-2020-26890: Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federa... Affects matrix-synapse versions < 1.20.0. Fixed in 1.20.0. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2020-26890 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix Synapse is a popular Python package that serves as a reference implementation of the Matrix communication protocol. It enables decentralized and secure communication between users and supports features such as instant messaging, voice calls, and file sharing. Matrix Synapse is widely used by organizations and individuals to host their own Matrix homeservers. However, a vulnerability has been discovered in versions prior to 1.20.0 that allows remote attackers to execute a denial of service attack against the federation and common Matrix clients.
Vulnerability Detail
The vulnerability (CVE-2020-26890) in Matrix Synapse arises from the incorrect handling of non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events. This flaw allows an attacker to craft a malformed event that, if accepted into the room's state, can cause long-lasting impact and disrupt the federation and common Matrix clients. The impact of this vulnerability extends beyond the server of the event sender, as the events are replicated to servers of other room members. Upgrading to a newer version of Matrix Synapse does not fix the issue, and manual redaction of the event is required to mitigate the vulnerability.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.0
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.20.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading Matrix Synapse to the latest version.
Conclusion
The Matrix Synapse JSON Denial of Service vulnerability (CVE-2020-26890) poses a significant risk to the federation and common Matrix clients. It is crucial to upgrade Matrix Synapse to version 1.20.0 or later to mitigate this vulnerability. Manual redaction of the event is not required after upgrading. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
Matrix Synapse is a Python package that implements the Matrix communication protocol, allowing decentralized and secure communication between users.
The vulnerability allows remote attackers to execute a denial of service attack against the federation and common Matrix clients, potentially disrupting communication services.
Yes, upgrading Matrix Synapse to version 1.20.0 or later fixes the vulnerability by properly handling non-standard JSON values in m.room.member events.
No, upgrading to the patched version of Matrix Synapse eliminates the vulnerability without the need for manual redaction.
No, there is no known workaround. It is crucial to upgrade to the fixed version of Matrix Synapse.
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
