matrix-rust-sdk vulnerabilities

Latest matrix-rust-sdk CVEs

Newest publication first

1. CVE-2025-66622 matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values

   Published 2025-12-09

   Low·CVSS 1.3 EPSS 0.44%

   matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is inv...

2. CVE-2022-39252 When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder

   Published 2022-09-29

   High·CVSS 7.5 EPSS 0.63%

   matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.