MEDIUM6.5PyPI
GHSA-22p3-qrh9-cx32· CVE-2022-31052, PYSEC-2022-224URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths
Modified: 9/30/2024
package
PyPI/matrix-synapse
pkg:pypi/matrix-synapse
MEDIUM6.9PyPI
GHSA-246w-56m2-5899· CVE-2021-21332, PYSEC-2021-133Cross-site scripting (XSS) vulnerability in the password reset endpoint
Modified: 7/8/2026
MEDIUM5.4PyPI
GHSA-26c5-ppr8-f33p· CVE-2023-32682, PYSEC-2023-84Synapse has improper checks for deactivated users during login
Modified: 9/10/2026
MEDIUM4.3PyPI
GHSA-2hwx-mjrm-v3g8· CVE-2021-21274, PYSEC-2021-132Denial of service attack via .well-known lookups
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-3h7q-rfh9-xm4v· CVE-2024-31208, PYSEC-2024-50Synapse V2 state resolution weakness allows Denial of Service (DoS)
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-3hfw-x7gx-437c· CVE-2021-41281, PYSEC-2021-436Path traversal in Matrix Synapse
Modified: 7/8/2026
LOW3.1PyPI
GHSA-3x4c-pq33-4w3q· CVE-2021-39164, PYSEC-2021-425Improper authorisation of members discloses room membership to non-members
Modified: 7/8/2026
MEDIUM6.1PyPI
GHSA-3x8c-fmpc-5rmq· CVE-2020-26891, PYSEC-2020-238Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
Modified: 7/8/2026
MEDIUM5.0PyPI
GHSA-45cj-f97f-ggwv· CVE-2022-39335, PYSEC-2023-65Synapse does not apply enough checks to servers requesting auth events of events in a room
Modified: 9/24/2024
MEDIUM5.3PyPI
GHSA-4822-jvwx-w47h· CVE-2022-41952, PYSEC-2026-663Uncontrolled Resource Consumption in Matrix Synapse
Modified: 7/6/2026
LOW3.7PyPI
GHSA-4f74-84v3-j9q5· CVE-2023-41335, PYSEC-2023-185matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-4mhg-xv73-xq2x· CVE-2024-37302, PYSEC-2024-286Synapse denial of service through media disk space consumption
Modified: 6/6/2026
HIGH7.5PyPI
GHSA-4mp3-385r-v63f· CVE-2020-26890, PYSEC-2020-237Denial of service attack due to invalid JSON
Modified: 7/8/2026
MEDIUM4.3PyPI
GHSA-56w4-5538-8v8h· CVE-2024-53867, PYSEC-2026-1610Synapse Matrix has a partial room state leak via Sliding Sync
Modified: 7/7/2026
MEDIUM4.9PyPI
GHSA-5chr-wjw5-3gq4· CVE-2023-45129, PYSEC-2023-199matrix-synapse vulnerable to denial of service due to malicious server ACL events
Modified: 9/10/2026
MEDIUM6.3PyPI
GHSA-5wrh-4jwv-5w78· CVE-2021-21392, PYSEC-2021-25Open redirect via transitional IPv6 addresses on dual-stack networks
Modified: 7/8/2026
MEDIUMPyPI
GHSA-6qf2-7x63-mm6v· CVE-2026-45076, PYSEC-2026-194Synapse pagination Denial of Service
Modified: 9/10/2026
LOW3.1PyPI
GHSA-7565-cq32-vx2x· CVE-2023-42453, PYSEC-2023-180matrix-synapse vulnerable to improper validation of receipts allows forged read receipts
Modified: 9/10/2026
MEDIUMPyPI
GHSA-7h5v-85w9-pq6cDenial of service (via resource exhaustion) due to improper input validation in third-party identifier endpoint
Modified: 12/2/2024
MEDIUM5.5PyPI
GHSA-8q93-326v-3m7g· CVE-2026-45078, PYSEC-2026-191Synapse CPU starvation (Denial of Service)
Modified: 9/10/2026
LOW3.5PyPI
GHSA-98px-6486-j7qc· CVE-2023-32683, PYSEC-2023-85Synapse has URL deny list bypass via oEmbed and image URLs when generating previews
Modified: 9/30/2024
MEDIUM6.1PyPI
GHSA-c5f8-35qr-q4fm· CVE-2021-21333, PYSEC-2021-134HTML injection in email and account expiry notifications
Modified: 7/8/2026
HIGH7.5PyPI
GHSA-ch5v-fhg8-7gv9· CVE-2018-12423, PYSEC-2026-844Matrix Synapse Authorization Error
Modified: 7/7/2026
HIGH8.6PyPI
GHSA-cppw-2mf8-qpm5· CVE-2019-18835, PYSEC-2019-186Improper Verification of Cryptographic Signature in matrix-synapse
Modified: 2/15/2025
HIGHPyPI
GHSA-f3r3-h2mq-hx2h· CVE-2024-52815, PYSEC-2026-1611Synapse allows a a malformed invite to break the invitee's `/sync`
Modified: 7/7/2026
MEDIUM5.0PyPI
GHSA-f3wc-3vxv-xmvr· CVE-2023-32323, PYSEC-2023-67Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
Modified: 2/13/2025
MEDIUMPyPI
GHSA-fh66-fcv5-jjfr· CVE-2025-61672, PYSEC-2026-1612Synapse's invalid device keys degrade federation functionality
Modified: 7/7/2026
HIGH8.8PyPI
GHSA-fmvh-rvq5-hhjx· CVE-2018-16515, PYSEC-2026-845Matrix Synapse Improper Signature Validation
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-gjgr-7834-rhxr· CVE-2024-37303, PYSEC-2024-287Synapse's unauthenticated writes to the media repository allow planting of problematic content
Modified: 6/6/2026
HIGH7.5PyPI
GHSA-gwf7-vfjf-wf6x· CVE-2019-11842, PYSEC-2019-185matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG
Modified: 7/13/2026
MEDIUM6.5PyPI
GHSA-hxmp-pqch-c8mm· CVE-2020-26257, PYSEC-2020-236Denial of service attack via incorrect parameters in Matrix Synapse
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-jhjh-776m-4765· CVE-2022-31152, PYSEC-2022-262Denial of service due to incorrect application of event authorization rules
Modified: 9/30/2024
LOW3.1PyPI
GHSA-jj53-8fmw-f2w2· CVE-2021-39163, PYSEC-2021-424Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
Modified: 7/8/2026
MEDIUM5.3PyPI
GHSA-jrh7-mhhx-6h88· CVE-2021-21393, PYSEC-2021-26Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
Modified: 7/8/2026
HIGH7.5PyPI
GHSA-jrqm-v8cv-53ww· CVE-2019-5885, PYSEC-2019-187Matrix Synapse Predictable Secret Key
Modified: 9/24/2024
MEDIUM5.3PyPI
GHSA-mp92-3jfm-3575· CVE-2023-43796, PYSEC-2023-230Synapse vulnerable to leak of remote user device information
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-p9qp-c452-f9r7· CVE-2022-39374, PYSEC-2023-66Synapse Denial of service due to incorrect application of event authorization rules during state resolution
Modified: 9/30/2024
HIGHPyPI
GHSA-rfq8-j7rh-8hf2· CVE-2024-52805, PYSEC-2026-1613Synapse allows unsupported content types to lead to memory exhaustion
Modified: 7/7/2026
HIGH7.1PyPI
GHSA-v56r-hwv5-mxg6· CVE-2025-30355, PYSEC-2026-1614Synapse vulnerable to federation denial of service via malformed events
Modified: 7/7/2026
HIGH7.5PyPI
GHSA-v8wm-g9f2-xjv4· CVE-2018-12291, PYSEC-2026-664Matrix Synapse Security Filtering Flaw
Modified: 7/6/2026
LOW3.1PyPI
GHSA-v936-j8gp-9q3p· CVE-2021-21273, PYSEC-2021-131Open redirects on some federation and push requests
Modified: 7/8/2026
HIGH7.5PyPI
GHSA-vmcc-4p4x-x7wg· CVE-2018-10657, PYSEC-2026-846Matrix Synapse DoS
Modified: 7/7/2026
HIGHPyPI
GHSA-vp6v-whfm-rv3g· CVE-2024-53863, PYSEC-2026-1615Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-w9fg-xffh-p362· CVE-2021-21394, PYSEC-2021-27Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
Modified: 7/8/2026
LOW3.7PyPI
GHSA-x345-32rc-8h85· CVE-2021-29471, PYSEC-2021-135Denial of service attack via push rule patterns in matrix-synapse
Modified: 7/8/2026
—PyPI
PYSEC-2019-185· CVE-2019-11842, GHSA-gwf7-vfjf-wf6xModified: 7/13/2026
—PyPI
PYSEC-2019-186· CVE-2019-18835, GHSA-cppw-2mf8-qpm5Modified: 11/8/2023
—PyPI
PYSEC-2019-187· CVE-2019-5885, GHSA-jrqm-v8cv-53wwModified: 6/10/2026
—PyPI
PYSEC-2020-236· CVE-2020-26257, GHSA-hxmp-pqch-c8mmModified: 11/8/2023
—PyPI
PYSEC-2020-237· CVE-2020-26890, GHSA-4mp3-385r-v63fModified: 11/8/2023
—PyPI
PYSEC-2020-238· CVE-2020-26891, GHSA-3x8c-fmpc-5rmqModified: 11/8/2023
—PyPI
PYSEC-2021-131· CVE-2021-21273, GHSA-v936-j8gp-9q3pModified: 11/8/2023
—PyPI
PYSEC-2021-132· CVE-2021-21274, GHSA-2hwx-mjrm-v3g8Modified: 11/8/2023
—PyPI
PYSEC-2021-133· CVE-2021-21332, GHSA-246w-56m2-5899Modified: 11/8/2023
—PyPI
PYSEC-2021-134· CVE-2021-21333, GHSA-c5f8-35qr-q4fmModified: 11/8/2023
—PyPI
PYSEC-2021-135· CVE-2021-29471, GHSA-x345-32rc-8h85Modified: 11/8/2023
—PyPI
PYSEC-2021-25· CVE-2021-21392, GHSA-5wrh-4jwv-5w78Modified: 11/8/2023
—PyPI
PYSEC-2021-26· CVE-2021-21393, GHSA-jrh7-mhhx-6h88Modified: 11/8/2023
—PyPI
PYSEC-2021-27· CVE-2021-21394, GHSA-w9fg-xffh-p362Modified: 11/8/2023
—PyPI
PYSEC-2021-424· CVE-2021-39163, GHSA-jj53-8fmw-f2w2Modified: 2/26/2026
—PyPI
PYSEC-2021-425· CVE-2021-39164, GHSA-3x4c-pq33-4w3qModified: 2/26/2026
—PyPI
PYSEC-2021-436· CVE-2021-41281, GHSA-3hfw-x7gx-437cModified: 2/26/2026
—PyPI
PYSEC-2022-224· CVE-2022-31052, GHSA-22p3-qrh9-cx32Modified: 11/8/2023
—PyPI
PYSEC-2022-262· CVE-2022-31152, GHSA-jhjh-776m-4765Modified: 11/8/2023
MEDIUM4.3PyPI
PYSEC-2023-180· CVE-2023-42453, GHSA-7565-cq32-vx2xModified: 11/8/2023
LOW3.7PyPI
PYSEC-2023-185· CVE-2023-41335, GHSA-4f74-84v3-j9q5Modified: 11/8/2023
MEDIUM4.9PyPI
PYSEC-2023-199· CVE-2023-45129, GHSA-5chr-wjw5-3gq4Modified: 11/8/2023
MEDIUM5.3PyPI
PYSEC-2023-230· CVE-2023-43796, GHSA-mp92-3jfm-3575Modified: 11/8/2023
—PyPI
PYSEC-2023-65· CVE-2022-39335, GHSA-45cj-f97f-ggwvModified: 11/8/2023
—PyPI
PYSEC-2023-66· CVE-2022-39374, GHSA-p9qp-c452-f9r7Modified: 11/8/2023
—PyPI
PYSEC-2023-67· CVE-2023-32323, GHSA-f3wc-3vxv-xmvrModified: 11/8/2023
—PyPI
PYSEC-2023-84· CVE-2023-32682, GHSA-26c5-ppr8-f33pModified: 11/8/2023
—PyPI
PYSEC-2023-85· CVE-2023-32683, GHSA-98px-6486-j7qcModified: 11/8/2023
HIGH7.5PyPI
PYSEC-2024-286· CVE-2024-37302, GHSA-4mhg-xv73-xq2xModified: 5/20/2026
MEDIUM5.3PyPI
PYSEC-2024-287· CVE-2024-37303, GHSA-gjgr-7834-rhxrModified: 5/20/2026
—PyPI
PYSEC-2024-50· CVE-2024-31208, GHSA-3h7q-rfh9-xm4vModified: 4/23/2024
MEDIUM4.3PyPI
PYSEC-2026-1610· CVE-2024-53867, GHSA-56w4-5538-8v8hSynapse Matrix has a partial room state leak via Sliding Sync
Modified: 7/7/2026
—PyPI
PYSEC-2026-1611· CVE-2024-52815, GHSA-f3r3-h2mq-hx2hSynapse allows a a malformed invite to break the invitee's `/sync`
Modified: 7/7/2026
—PyPI
PYSEC-2026-1612· CVE-2025-61672, GHSA-fh66-fcv5-jjfrSynapse's invalid device keys degrade federation functionality
Modified: 7/7/2026
—PyPI
PYSEC-2026-1613· CVE-2024-52805, GHSA-rfq8-j7rh-8hf2Synapse allows unsupported content types to lead to memory exhaustion
Modified: 7/7/2026
HIGH7.1PyPI
PYSEC-2026-1614· CVE-2025-30355, GHSA-v56r-hwv5-mxg6Synapse vulnerable to federation denial of service via malformed events
Modified: 7/7/2026
—PyPI
PYSEC-2026-1615· CVE-2024-53863, GHSA-vp6v-whfm-rv3gSynapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
Modified: 7/7/2026
MEDIUM5.5PyPI
PYSEC-2026-191· CVE-2026-45078, GHSA-8q93-326v-3m7gModified: 6/3/2026
LOW2.7PyPI
PYSEC-2026-194· CVE-2026-45076, GHSA-6qf2-7x63-mm6vModified: 6/5/2026
MEDIUM5.3PyPI
PYSEC-2026-663· CVE-2022-41952, GHSA-4822-jvwx-w47hUncontrolled Resource Consumption in Matrix Synapse
Modified: 7/6/2026
HIGH7.5PyPI
PYSEC-2026-664· CVE-2018-12291, GHSA-v8wm-g9f2-xjv4Matrix Synapse Security Filtering Flaw
Modified: 7/6/2026
HIGH7.5PyPI
PYSEC-2026-844· CVE-2018-12423, GHSA-ch5v-fhg8-7gv9Matrix Synapse Authorization Error
Modified: 7/7/2026
HIGH8.8PyPI
PYSEC-2026-845· CVE-2018-16515, GHSA-fmvh-rvq5-hhjxMatrix Synapse Improper Signature Validation
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-846· CVE-2018-10657, GHSA-vmcc-4p4x-x7wgMatrix Synapse DoS
Modified: 7/7/2026