matrix-synapse has 33 CVEs on record between 2020 and 2026. The median CVSS is 5.5 (medium). 3% have been exploited in the wild, in line with the corpus average.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 3% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 2
Weakness classes
Products
- matrix-synapse 33
Worst active — by depth score
matrix-synapse vulnerabilities
CVEs affecting matrix-synapse, newest first. Open any entry for full detail, references, and exploit status.
33 CVEsRSS
CVE-2026-45078Medium· 5.5Synapse CPU starvation (Denial of Service)
Synapse CPU starvation (Denial of Service)
CVE-2026-45076MediumSynapse pagination Denial of Service
Synapse pagination Denial of Service
CVE-2025-61672MediumSynapse is an open source Matrix homeserver implementation
Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, un…
CVE-2025-30355High· 7.1Synapse vulnerable to federation denial of service via malformed events
Synapse vulnerable to federation denial of service via malformed events
CVE-2024-53863HighSynapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
CVE-2024-52805HighSynapse allows unsupported content types to lead to memory exhaustion
Synapse allows unsupported content types to lead to memory exhaustion
CVE-2024-52815HighSynapse allows a a malformed invite to break the invitee's `/sync`
Synapse allows a a malformed invite to break the invitee's `/sync`
CVE-2024-53867Medium· 4.3Synapse Matrix has a partial room state leak via Sliding Sync
Synapse Matrix has a partial room state leak via Sliding Sync
CVE-2024-31208Medium· 6.5Synapse V2 state resolution weakness allows Denial of Service (DoS)
Synapse V2 state resolution weakness allows Denial of Service (DoS)
CVE-2023-43796Medium· 5.3Synapse vulnerable to leak of remote user device information
Synapse vulnerable to leak of remote user device information
CVE-2023-45129Medium· 4.9matrix-synapse vulnerable to denial of service due to malicious server ACL events
matrix-synapse vulnerable to denial of service due to malicious server ACL events
CVE-2023-42453Low· 3.1matrix-synapse vulnerable to improper validation of receipts allows forged read receipts
matrix-synapse vulnerable to improper validation of receipts allows forged read receipts
CVE-2023-41335Low· 3.7matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes
matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes
CVE-2023-32682Medium· 5.4Synapse has improper checks for deactivated users during login
Synapse has improper checks for deactivated users during login
CVE-2018-10657High· 7.5⚠ Exploited0dayMatrix Synapse DoS
Matrix Synapse DoS
CVE-2018-12291High· 7.5Matrix Synapse Security Filtering Flaw
Matrix Synapse Security Filtering Flaw
CVE-2018-16515High· 8.8Matrix Synapse Improper Signature Validation
Matrix Synapse Improper Signature Validation
CVE-2018-12423High· 7.5Matrix Synapse Authorization Error
Matrix Synapse Authorization Error
CVE-2022-41952Medium· 5.3Uncontrolled Resource Consumption in Matrix Synapse
Uncontrolled Resource Consumption in Matrix Synapse
CVE-2021-41281High· 7.5Path traversal in Matrix Synapse
Path traversal in Matrix Synapse
CVE-2021-39163Low· 3.1Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
CVE-2021-39164Low· 3.1Improper authorisation of members discloses room membership to non-members
Improper authorisation of members discloses room membership to non-members
CVE-2021-29471Low· 3.7Denial of service attack via push rule patterns in matrix-synapse
Denial of service attack via push rule patterns in matrix-synapse
CVE-2021-21394Medium· 5.3Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
CVE-2021-21393Medium· 5.3Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
CVE-2021-21392Medium· 6.3Open redirect via transitional IPv6 addresses on dual-stack networks
Open redirect via transitional IPv6 addresses on dual-stack networks
CVE-2021-21333Medium· 6.1HTML injection in email and account expiry notifications
HTML injection in email and account expiry notifications
CVE-2021-21332Medium· 6.9Cross-site scripting (XSS) vulnerability in the password reset endpoint
Cross-site scripting (XSS) vulnerability in the password reset endpoint
CVE-2021-21274Medium· 4.3Denial of service attack via .well-known lookups
Denial of service attack via .well-known lookups
CVE-2021-21273Low· 3.1Open redirects on some federation and push requests
Open redirects on some federation and push requests