---
id: CVE-2025-61672
title: Synapse is an open source Matrix homeserver implementation
summary: >-
  Synapse is an open source Matrix homeserver implementation. Lack of validation
  for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an
  attacker registered on the victim homeserver to degrade federation
  functionality, un…
severity: medium
cwe:
  - CWE-1287
vendor: matrix-synapse
product: matrix-synapse
affected:
  - matrix-synapse < 1.138.3
  - 'matrix-synapse >= 1.139.0rc2, < 1.139.1'
patched:
  - matrix-synapse 1.138.3
  - matrix-synapse 1.139.1
published: '2025-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61672'
references:
  - url: >-
      https://github.com/element-hq/synapse/commit/26aaaf9e48fff80cf67a20c691c75d670034b3c1
    label: security-advisories@github.com
  - url: >-
      https://github.com/element-hq/synapse/commit/7069636c2d6d1ef2022287addf3ed8b919ef2740
    label: security-advisories@github.com
  - url: 'https://github.com/element-hq/synapse/pull/17097'
    label: security-advisories@github.com
  - url: 'https://github.com/element-hq/synapse/releases/tag/v1.138.3'
    label: security-advisories@github.com
  - url: 'https://github.com/element-hq/synapse/releases/tag/v1.139.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61672'
  - url: 'https://github.com/element-hq/synapse'
  - url: 'https://github.com/element-hq/synapse/releases/tag/v1.138.4'
  - url: 'https://github.com/element-hq/synapse/releases/tag/v1.139.2'
tags:
  - nvd
  - osv
  - pip
epss: 0.00466
epssPercentile: 0.4013
aliases:
  - GHSA-fh66-fcv5-jjfr
  - PYSEC-2026-1612
ecosystem: pip
ingestedAt: '2026-07-08T18:25:48.912Z'
---

## Overview

Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-61672)

Affected packages:

- `matrix-synapse < 1.138.3`
- `matrix-synapse >= 1.139.0rc2, < 1.139.1`

Patched in:

- `matrix-synapse 1.138.3`
- `matrix-synapse 1.139.1`

Source: https://osv.dev/vulnerability/GHSA-fh66-fcv5-jjfr