HighCVSS 7.1
The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.
Vendor
matrix vulnerabilities
76 published CVES affecting matrix, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 76
- Critical
- 5
- High
- 25
- Medium
- 42
- Low
- 4
- Unscored
- 0
- CISA KEV
- 0
Products
- synapse 33
- javascript sdk 9
- sydent 7
- matrix irc bridge 6
- olm 5
- software development kit 4
- Tafnit v8 4
- dendrite 2
- element 2
- Matrix specification 2
- matrix-appservice-bridge 2
- gomatrixserverlib 1
- hookshot 1
- matrix-android-sdk2 1
- matrix-rust-sdk 1
- react sdk 1
Latest matrix CVEs
Newest publication first · page 1 of 4
-
-
HighCVSS 7.1
The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.
-
MediumCVSS 4.3
An issue was discovered in Matrix libolm through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does not ensure that S < n). This refers to the libolm implementation of Olm. NOTE: This vulnerability only affects products that are no longer sup...
-
MediumCVSS 5.3
An issue was discovered in Matrix libolm through 3.2.16. Cache-timing attacks can occur due to use of base64 when decoding group session keys. This refers to the libolm implementation of Olm. NOTE: This vulnerability only affects products that are no longer supported by the maint...
-
MediumCVSS 5.3
An issue was discovered in Matrix libolm through 3.2.16. The AES implementation is vulnerable to cache-timing attacks due to use of S-boxes. This is related to software that uses a lookup table for the SubWord step. This refers to the libolm implementation of Olm. NOTE: This vuln...
-
MediumCVSS 5.5
Matrix Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File
-
MediumCVSS 5.3
Matrix Tafnit v8 CWE-204: Observable Response Discrepancy
-
MediumCVSS 5.4
Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
HighCVSS 7.5
Matrix Tafnit v8 CWE-552: Files or Directories Accessible to External Parties
-
MediumCVSS 5.3
Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Syna...
-
CVE-2023-45129 matrix-synapse vulnerable to denial of service due to malicious server ACL events
PublishedMediumCVSS 4.9 EPSS 1.4%Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed fede...
-
CriticalCVSS 9.0
matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have generic.allowJsTransformationFunctions in their config), may be vulnerable to an attack where it is possi...
-
CVE-2023-41335 Temporary storage of plaintext passwords during password changes in matrix synapse
PublishedLowCVSS 3.7 EPSS 0.39%Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the use...
-
CVE-2023-42453 Improper validation of receipts allows forged read receipts in matrix synapse
PublishedMediumCVSS 4.3Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This co...
-
LowCVSS 3.7
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Version 1.0.1n fixes this issue. As...
-
MediumCVSS 6.5
matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning A...
-
CVE-2023-38690 matrix-appservice-irc IRC command injection via admin commands containing newlines
PublishedCriticalCVSS 9.8matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge b...
-
MediumCVSS 5.3
Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle (MITM) attack. Att...
-
CVE-2023-32683 URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
PublishedMediumCVSS 5.4Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the url_preview_url_blacklist setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresse...
-
MediumCVSS 5.4 EPSS 0.75%
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for...
-
MediumCVSS 6.5
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the curre...
-
MediumCVSS 5.0 EPSS 0.64%
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those...
-
MediumCVSS 4.3
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with f...
-
MediumCVSS 5.3
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk user...
-
MediumCVSS 5.3
matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application ca...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.