CVE-2023-45129: Denial of Service Vulnerability in matrix-synapse
Summary
CVE-2023-45129: matrix-synapse vulnerable to denial of service due to malicious server ACL events. Affects matrix-synapse versions < 1.94.0. Fixed in 1.94.0. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2023-45129 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-synapse is an open-source server implementation of the Matrix protocol, which enables secure and decentralized communication. It allows users to create and join chat rooms, exchange messages, and share media. The vulnerability identified in matrix-synapse can lead to a denial of service (DoS) attack when malicious server ACL events are triggered. This can result in temporary or permanent performance issues, causing a persistent DoS. Homeservers operating on a closed federation are not affected by this vulnerability.
Vulnerability Detail
The vulnerability arises from the ability of a malicious server to exploit server ACL events, impacting the performance of the matrix-synapse server. This can lead to a denial of service, affecting the availability of the service. The impact can be temporary or permanent, depending on the severity of the attack. Synapse versions prior to 1.94.0 are susceptible to this vulnerability.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.94.0
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.94.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
In cases where rooms have already been affected by malicious server ACL events, administrators can utilize the admin API to purge and block these rooms. The admin API provides the functionality to remove and prevent further impact from the malicious events. Detailed instructions on how to perform this workaround can be found in the Synapse documentation: https://matrix-org.github.io/synapse/latest/admin_api/rooms.html#version-2-new-version
Conclusion
The vulnerability in matrix-synapse can lead to a denial of service when malicious server ACL events are triggered. Upgrading to version 1.94.0 or later is crucial to mitigate this vulnerability. Additionally, administrators can utilize the admin API to purge and block affected rooms. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
The vulnerability can result in a denial of service, causing performance issues on the matrix-synapse server. This can lead to temporary or permanent unavailability of the service.
No, only matrix-synapse servers running on open federations and utilizing server ACLs are vulnerable to this issue. Closed federation homeservers are not affected.
To check the version of matrix-synapse installed on your server, you can use the following command: <code>synctl --version</code>
Yes, the vulnerability can be addressed by upgrading matrix-synapse to version 1.94.0 or later. This update includes the necessary patches to mitigate the denial of service vulnerability.
Yes, administrators can utilize the admin API to purge and block rooms affected by malicious server ACL events. This prevents further impact from these events.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
