CVE-2023-43796: Open Source Vulnerability in matrix-synapse
Summary
CVE-2023-43796: Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. Affects matrix-synapse across 2 version ranges.
< 1.95.1
< daec55e1fe120c564240c5386e77941372bf458f
Fixed in daec55e1fe120c564240c5386e77941372bf458f. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2023-43796 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-synapse is an open-source Matrix homeserver that allows users to communicate and collaborate in real-time. It provides a decentralized messaging platform and is widely used for secure communication. However, prior to versions 1.95.1 and 1.96.0rc1, a vulnerability exists in matrix-synapse that allows for the querying of cached device information of remote users. This vulnerability can be exploited to enumerate the remote users known to a homeserver, potentially compromising user privacy and security.
Vulnerability Detail
The vulnerability in matrix-synapse arises from the ability to query cached device information of remote users. By exploiting this vulnerability, an attacker can gather information about the remote users known to a homeserver. This can lead to privacy breaches and potentially enable further attacks. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
daec55e1fe120c564240c5386e77941372bf458f
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==daec55e1fe120c564240c5386e77941372bf458f"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, the 'federation_domain_whitelist' configuration option can be used to limit federation traffic with a homeserver. By specifying a whitelist of trusted federation domains, the homeserver can restrict communication to only those domains, reducing the risk of exposing cached device information. The configuration change can be made in the Synapse configuration file.
Conclusion
The vulnerability in matrix-synapse allows for the querying of cached device information of remote users, potentially compromising user privacy and security. To mitigate this vulnerability, it is crucial to upgrade to the patched versions of Synapse or implement the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
matrix-synapse is an open-source Matrix homeserver that enables real-time communication and collaboration.
The vulnerability allows for the enumeration of remote users known to a homeserver, potentially compromising user privacy and security.
To fix this vulnerability, upgrade to Synapse version 1.95.1 or 1.96.0rc1, which includes a patch for this issue.
Yes, a temporary workaround is to use the 'federation_domain_whitelist' configuration option to limit federation traffic with a homeserver.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
