Log in Start free

Vulnerability · Published Apr 23, 2024 · Assigned by GitHub_M

CVE-2024-31208Synapse's V2 state resolution weakness allows DoS from remote room members

Medium 6.5

In plain English

A medium-severity resource allocation without limits in synapse from element-hq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.5%top 26.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate excessive data in the database of such instances, resulting in a denial of service. Servers in private federations, or those that do not federate, are not affected. Server administrators should upgrade to 1.105.1 or later. Some workarounds are available. One can ban the malicious users or ACL block servers from the rooms and/or leave the room and purge the room using the admin API.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20synapse1.105.1-r0ALPINE-CVE-2024-31208
Alpine:v3.21synapse1.105.1-r0ALPINE-CVE-2024-31208
Alpine:v3.22synapse1.105.1-r0ALPINE-CVE-2024-31208
Alpine:v3.23synapse1.105.1-r0ALPINE-CVE-2024-31208
Alpine:v3.24synapse1.105.1-r0ALPINE-CVE-2024-31208
Debian:14matrix-synapse1.103.0-2DEBIAN-CVE-2024-31208
PyPImatrix-synapse1.105.1PYSEC-2024-50
PyPImatrix-synapse1.105.1GHSA-3h7q-rfh9-xm4v
Ubuntu:24.04:LTSmatrix-synapseno fix listedUBUNTU-CVE-2024-31208
Ubuntu:22.04:LTSsynapseno fix listedUBUNTU-CVE-2024-31208
Ubuntu:24.04:LTSsynapseno fix listedUBUNTU-CVE-2024-31208
Ubuntu:25.10synapseno fix listedUBUNTU-CVE-2024-31208
Ubuntu:26.04:LTSsynapseno fix listedUBUNTU-CVE-2024-31208
Ubuntu:26.10synapseno fix listedUBUNTU-CVE-2024-31208

Affected products (as reported)

VendorProductVersions
element-hq synapse < 1.105.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References