CVE-2022-31052: URL previews can crash Synapse media repositories or Synapse monoliths
Summary
CVE-2022-31052: Impact URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. Affects matrix-synapse versions < 1.61.1. Fixed in 1.61.1. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2022-31052 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is matrix-synapse, an open-source server implementation of the Matrix protocol. Matrix is an open standard for secure, decentralized, real-time communication. Synapse is responsible for handling the storage and replication of Matrix rooms, as well as user authentication and authorization. It supports various features, including URL previews, which allow users to see a preview of web pages before visiting them. However, a vulnerability in Synapse's URL preview functionality can lead to stack exhaustion and potential crashes.
Vulnerability Detail
The vulnerability arises from unbounded recursion in the URL preview process. When a web page with unusual or malicious content is requested for a preview, it can cause the Synapse process to exhaust its stack space. This can result in a crash or an error for the request causing the problem. Malicious users on the homeserver or remote users sending URLs that trigger automatic URL previews can exploit this vulnerability. However, remote users cannot directly exploit it as the URL preview endpoint requires authentication. The impact of this vulnerability can disrupt the availability of the Synapse process and potentially lead to denial-of-service attacks.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.61.1
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.61.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to disable URL previews in the configuration file by setting 'url_preview_enabled' to false. Additionally, deployments using workers can offload URL previews to dedicated worker processes to prevent disruptions to other Synapse functionality.
Conclusion
The vulnerability in the URL preview functionality of matrix-synapse can lead to stack exhaustion and potential crashes. Administrators should upgrade to the latest version of the package and consider implementing the recommended workarounds to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
Deployments with 'url_preview_enabled' set to true in the configuration are affected. Deployments with 'url_preview_enabled' set to false or with no configuration value set are not affected.
Remote users cannot directly exploit this vulnerability as the URL preview endpoint requires authentication. However, they can send URLs that trigger automatic URL previews for local users.
The severity of this vulnerability is considered moderate, with a CVSS score of 6.5.
Yes, administrators are advised to upgrade to version 1.61.1 or higher of the matrix-synapse package to apply the necessary patches.
Another alternative workaround is to deploy dedicated worker processes for URL previews to isolate them from the main Synapse process.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
