CVE-2022-31052: Stack Exhaustion in matrix-synapse
Summary
CVE-2022-31052: Synapse is an open source home server implementation for the Matrix chat network. Affects matrix-synapse across 2 version ranges.
< 1.61.1
< fa1308061802ac7b7d20e954ba7372c5ac292333
Fixed in fa1308061802ac7b7d20e954ba7372c5ac292333. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2022-31052 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-synapse is an open source home server implementation for the Matrix chat network. It provides functionality for hosting Matrix chat rooms, handling user authentication, and facilitating communication between users. The package is widely used and allows users to interact with the Matrix network through various clients. However, versions prior to 1.61.1 are vulnerable to a stack exhaustion issue in the URL preview feature.
Vulnerability Detail
The vulnerability in matrix-synapse versions prior to 1.61.1 arises from unbounded recursion in the URL preview functionality. When certain web pages are previewed, it can cause the Synapse process to exhaust the available stack space. This can result in different outcomes, such as an error for the request causing the problem or a complete crash of the Synapse process. Malicious users on the homeserver or remote users sending URLs that trigger URL previews can exploit this vulnerability. However, remote users cannot directly exploit it due to the authentication requirement for the URL preview endpoint. Deployments with URL previews disabled are not affected. Homeserver administrators are advised to upgrade to version 1.61.1 or higher to mitigate this vulnerability.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
fa1308061802ac7b7d20e954ba7372c5ac292333
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==fa1308061802ac7b7d20e954ba7372c5ac292333"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, homeserver administrators can disable the URL preview feature by setting the 'url_preview_enabled' configuration option to false. This can be done by modifying the configuration file of matrix-synapse and restarting the Synapse process. However, disabling URL previews may impact the user experience for clients that rely on this feature.
Conclusion
The stack exhaustion vulnerability in matrix-synapse versions prior to 1.61.1 can be mitigated by upgrading to the fixed version or disabling the URL preview feature. Homeserver administrators are advised to take appropriate action to secure their installations. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
matrix-synapse is an open source home server implementation for the Matrix chat network. It allows users to host Matrix chat rooms, handle user authentication, and facilitate communication between users.
Versions of matrix-synapse prior to 1.61.1 are affected by this vulnerability.
The vulnerability can lead to stack exhaustion in the Synapse process, causing errors or crashes. Malicious users or remote users sending URLs triggering URL previews can exploit this vulnerability.
To fix this vulnerability, upgrade matrix-synapse to version 1.61.1 or higher. Alternatively, disable the URL preview feature by setting 'url_preview_enabled' to false in the configuration.
No, remote users cannot directly exploit this vulnerability due to the authentication requirement for the URL preview endpoint.
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
