Product by Matrix
Matrix Synapse
40 known vulnerabilities in Matrix Synapse (Matrix), 0 of them actively exploited (CISA KEV).
Key figures
40
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2020-26890 | Matrix Synapse: Denial of Service | 7.5 | |
| High | CVE-2019-5885 | Matrix Synapse: security vulnerability | 7.5 | |
| Medium | CVE-2020-26257 | Denial of service attack via incorrect parameters to federation APIs | 6.5 | |
| High | CVE-2018-16515 | Matrix Synapse: security vulnerability | 8.8 | |
| High | CVE-2018-12423 | Matrix Synapse: security vulnerability | 7.5 | |
| High | CVE-2019-11842 | Matrix Sydent: security vulnerability | 7.5 | |
| High | CVE-2018-12291 | Matrix Synapse: security vulnerability | 7.5 | |
| High | CVE-2021-41281 | Path traversal in Matrix Synapse | 7.5 | |
| High | CVE-2025-30355 | Synapse vulnerable to federation denial of service via malformed events | 7.1 | |
| Medium | CVE-2020-26891 | Matrix Synapse: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2018-10657 | Matrix Synapse: Denial of Service | 7.5 | |
| Medium | CVE-2024-31208 | Synapse's V2 state resolution weakness allows DoS from remote room members | 6.5 | |
| Medium | CVE-2022-31052 | URL previews can crash Synapse media repositories or Synapse monoliths | 6.5 | |
| Critical | CVE-2019-18835 | Matrix Synapse: security vulnerability | 9.8 | |
| Medium | CVE-2021-21274 | Denial of service attack via .well-known lookups | 4.3 | |
| Medium | CVE-2021-21393 | Matrix-org Synapse: Improper Input Validation | 5.3 | |
| High | CVE-2021-21332 | Cross-site scripting (XSS) vulnerability in the password reset endpoint | 6.9 | |
| High | CVE-2024-52805 | Synapse allows unsupported content types to lead to memory exhaustion | 7.5 | |
| Critical | CVE-2024-53863 | Element-hq Synapse: Unrestricted Upload of File with Dangerous Type | 9.1 | |
| Medium | CVE-2021-21333 | HTML injection in email and account expiry notifications | 6.1 | |
| Medium | CVE-2021-21394 | Matrix-org Synapse: Improper Input Validation | 5.3 | |
| High | CVE-2022-31152 | Matrix-org Synapse: Improper Check or Handling of Exceptional Conditions | 6.4 | |
| Medium | CVE-2023-45129 | matrix-synapse vulnerable to denial of service due to malicious server ACL events | 4.9 | |
| High | CVE-2024-52815 | Synapse allows a a malformed invite to break the invitee's `/sync` | 5.3 | |
| Medium | CVE-2021-29471 | Denial of service in Matrix Synapse | 3.7 |