synapse
v1.165.0Synapse: Matrix homeserver written in Python/Twisted + Rust
- Maintenance
- Active424 commits in 3 months · bus factor 2
- License
- AGPL-3.0Copyleft · OSI-approved · changed in 2023
- Security
- 22 advisories14 high, 6 medium, 2 low
- Supported versions
- No scheduleendoflife.date does not track this project
4.8k stars · 670 forks · 2.1k open issues · last release 4 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 22 most recent advisories published by the maintainers: 14 high, 6 medium, 2 low. Check the patched version against the one you run.
- highCVE-2026-102531Jul 28, 2026Room aliases can be maliciously redirected to other rooms
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- highCVE-2026-102543Jul 28, 2026Synapse relays 401 Unauthorized federation responses to clients, causing them to log out
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- highCVE-2026-102533Jul 28, 2026Synapse accepts to-device messages which have been spoofed to look like they came from another server
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- highCVE-2026-102534Jul 28, 2026Resource exhaustion from user-configured push rules
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- lowCVE-2026-102597Jul 28, 2026Synapse accepts extraneous trailing (suffix) data on the URL of some endpoints, enabling access to unintended endpoints
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- lowCVE-2026-102595Jul 28, 2026Synapse allows insertion of extraneous HTTP path segments in some endpoints
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- highCVE-2026-102592Jul 28, 2026Synapse exhausts memory in response to malicious `multipart/form-data` requests
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- mediumCVE-2026-102591Jul 28, 2026Synapse produces invalid Sliding Sync responses if a room contains invalid name, avatar or user profile data
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- mediumCVE-2026-102542Jul 28, 2026Federation `/timestamp_to_event` endpoint discloses event IDs from unjoined room
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- mediumCVE-2026-102532Jul 28, 2026Federation `/event_auth` endpoint can disclose authorisation events from another room
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- highCVE-2026-102535Jul 28, 2026Federation `/get_missing_events` endpoint can disclose events from another room
- Affected
- < 1.157.2
- Patched in
- 1.157.2
- mediumCVE-2026-45076May 8, 2026Synapse pagination Denial of Service
- Affected
- < 1.152.1
- Patched in
- 1.152.1
- highCVE-2026-45078May 8, 2026Synapse CPU starvation (Denial of Service)
- Affected
- < 1.152.1
- Patched in
- 1.152.1
- highCVE-2025-61672Oct 8, 2025Invalid device keys degrade federation functionality
- Affected
- <1.138.3, =1.139.0
- Patched in
- 1.139.1, 1.139.2, 1.138.3, 1.138.4
- highCVE-2025-30355Mar 26, 2025Federation denial of service via malformed events
- Affected
- <= 1.127.0
- Patched in
- 1.127.1
- highCVE-2024-37302Dec 3, 2024Denial of service through media disk space consumption
- Affected
- < 1.106
- Patched in
- 1.106
- mediumCVE-2024-37303Dec 3, 2024Unauthenticated writes to the media repository allow planting of problematic content
- Affected
- < 1.106
- Patched in
- 1.106
- mediumCVE-2024-53867Dec 3, 2024Partial room state leak via Sliding Sync
- Affected
- >= 1.113.0rc1, < 1.120.1
- Patched in
- 1.120.1
- highCVE-2024-52805Dec 3, 2024Unsupported content types can lead to memory exhaustion
- Affected
- < 1.120.1
- Patched in
- 1.120.1
- highCVE-2024-52815Dec 3, 2024Malicious invites via federation can break a user's sync
- Affected
- < 1.120.1
- Patched in
- 1.120.1
- highCVE-2024-53863Dec 3, 2024Synapse can be forced to thumbnail unexpected file formats, invoking potentially untrustworthy decoders
- Affected
- < 1.120.1
- Patched in
- 1.120.1
- highCVE-2024-31208Apr 23, 2024Weakness in auth chain indexing allows DoS from remote room members through disk fill and high CPU usage
- Affected
- < 1.105.1
- Patched in
- 1.105.1