Vendor
Matrix
87 known vulnerabilities in products by Matrix, 0 of them actively exploited (CISA KEV).
Key figures
87
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
8
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2021-34813 | Matrix Olm: Stack-Based Buffer Overflow | 9.8 | |
| Critical | CVE-2021-44538 | Matrix Element: Buffer Overflow | 9.8 | |
| High | CVE-2020-26890 | Matrix Synapse: Denial of Service | 7.5 | |
| High | CVE-2019-5885 | Matrix Synapse: security vulnerability | 7.5 | |
| Medium | CVE-2020-26257 | Denial of service attack via incorrect parameters to federation APIs | 6.5 | |
| High | CVE-2018-16515 | Matrix Synapse: security vulnerability | 8.8 | |
| High | CVE-2021-29430 | Denial of service attack via memory exhaustion | 7.5 | |
| High | CVE-2018-12423 | Matrix Synapse: security vulnerability | 7.5 | |
| High | CVE-2019-11842 | Matrix Sydent: security vulnerability | 7.5 | |
| High | CVE-2018-12291 | Matrix Synapse: security vulnerability | 7.5 | |
| High | CVE-2021-41281 | Path traversal in Matrix Synapse | 7.5 | |
| High | CVE-2025-30355 | Synapse vulnerable to federation denial of service via malformed events | 7.1 | |
| Medium | CVE-2020-26891 | Matrix Synapse: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2018-10657 | Matrix Synapse: Denial of Service | 7.5 | |
| High | CVE-2022-39250 | Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification | 8.6 | |
| High | CVE-2022-39251 | Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion | 8.6 | |
| Medium | CVE-2024-31208 | Synapse's V2 state resolution weakness allows DoS from remote room members | 6.5 | |
| Medium | CVE-2022-31052 | URL previews can crash Synapse media repositories or Synapse monoliths | 6.5 | |
| High | CVE-2023-28427 | Prototype pollution in matrix-js-sdk | 8.2 | |
| Medium | CVE-2019-11340 | Matrix Sydent: security vulnerability | 5.9 | |
| High | CVE-2022-39249 | Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions | 7.5 | |
| High | CVE-2022-39255 | Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusion | 8.6 | |
| Critical | CVE-2019-18835 | Matrix Synapse: security vulnerability | 9.8 | |
| High | CVE-2022-39248 | matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion | 8.6 | |
| Medium | CVE-2021-21274 | Denial of service attack via .well-known lookups | 4.3 |
Products
| Matrix Synapse | 40 | 0 |
| Javascript SDK | 10 | 0 |
| Matrix Irc Bridge | 7 | 0 |
| Matrix Sydent | 7 | 0 |
| Olm | 5 | 0 |
| Software Development Kit | 4 | 0 |
| Tafnit V8 | 4 | 0 |