—
RUSTSEC-2025-0135
matrix-sdk-base: Denial of service due to custom `m.room.join_rules` events
Details
The matrix-sdk-base crate is unable to handle responses that include custom m.room.join_rules values due to a serialization bug.
This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/matrix-sdk-base
Introduced in:
0.0.0-0Fixed in: 0.16.0Upgrade matrix-sdk-base to 0.16.0 or newer (ecosystem crates.io).