Product by Matrix-org
Synapse
24 known vulnerabilities in Synapse (Matrix-org), 0 of them actively exploited (CISA KEV).
Key figures
24
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2020-26257 | Denial of service attack via incorrect parameters to federation APIs | 6.5 | |
| High | CVE-2021-41281 | Path traversal in Matrix Synapse | 7.5 | |
| Medium | CVE-2022-31052 | URL previews can crash Synapse media repositories or Synapse monoliths | 6.5 | |
| Medium | CVE-2021-21274 | Denial of service attack via .well-known lookups | 4.3 | |
| Medium | CVE-2021-21393 | Matrix-org Synapse: Improper Input Validation | 5.3 | |
| High | CVE-2021-21332 | Cross-site scripting (XSS) vulnerability in the password reset endpoint | 6.9 | |
| Medium | CVE-2021-21333 | HTML injection in email and account expiry notifications | 6.1 | |
| Medium | CVE-2021-21394 | Matrix-org Synapse: Improper Input Validation | 5.3 | |
| High | CVE-2022-31152 | Matrix-org Synapse: Improper Check or Handling of Exceptional Conditions | 6.4 | |
| Medium | CVE-2023-45129 | matrix-synapse vulnerable to denial of service due to malicious server ACL events | 4.9 | |
| Medium | CVE-2021-29471 | Denial of service in Matrix Synapse | 3.7 | |
| Medium | CVE-2022-39374 | Matrix-org Synapse: Uncontrolled Resource Consumption | 6.5 | |
| Medium | CVE-2021-21273 | Open redirects on some federation and push requests | 3.1 | |
| Medium | CVE-2022-41952 | Uncontrolled Resource Consumption in Matrix Synapse | 6.5 | |
| Medium | CVE-2021-21392 | Open redirect via transitional IPv6 addresses on dual-stack networks | 6.3 | |
| Medium | CVE-2023-32323 | Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites | 5.0 | |
| Medium | CVE-2023-43796 | Synapse vulnerable to leak of remote user device information | 5.3 | |
| Low | CVE-2021-39164 | Improper authorisation of /members discloses room membership to non-members | 3.1 | |
| Medium | CVE-2023-32682 | Improper checks for deactivated users during login in synapse | 5.4 | |
| Medium | CVE-2022-39335 | Synapse does not apply enough checks to servers requesting auth events of events in a room | 5.0 | |
| Medium | CVE-2023-42453 | Improper validation of receipts allows forged read receipts in matrix synapse | 3.1 | |
| Low | CVE-2021-39163 | Matrix-org Synapse: Exposure of Sensitive Information to an Unauthorized Actor | 3.1 | |
| Medium | CVE-2023-32683 | URL deny list bypass via oEmbed and image URLs when generating previews in Synapse | 3.5 | |
| Low | CVE-2023-41335 | Temporary storage of plaintext passwords during password changes in matrix synapse | 3.7 |