https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T22:25:03.909069+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-70960 cnvd-2020-70960 2026-10-05T22:25:03.916604+00:00 cnvd-2020-70960 https://cve.radiocsirt.org/vuln/euvd-2026-46005 EUVD-2026-46005 2026-10-05T22:25:03.916653+00:00 EUVD-2026-46005 https://cve.radiocsirt.org/vuln/fkie_cve-2020-26257 fkie_cve-2020-26257 2026-10-05T22:25:03.916681+00:00

Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).

 https://cve.radiocsirt.org/vuln/ghsa-hxmp-pqch-c8mm GHSA-hxmp-pqch-c8mm — Denial of service attack via incorrect parameters in Matrix Synapse 2026-10-05T22:25:03.916748+00:00

Affected: PyPI: matrix-synapse

### Impact

A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request.

This can lead to a denial of service in which future events will not be correctly sent to other servers over federation.

This affects any server which accepts federation requests from untrusted servers.

### Patches

Issue is resolved by https://github.com/matrix-org/synapse/pull/8776.

### Workarounds

Homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).

 https://cve.radiocsirt.org/vuln/gsd-2020-26257 gsd-2020-26257 2026-10-05T22:25:03.916807+00:00 gsd-2020-26257 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11041-1 openSUSE-SU-2024:11041-1 — matrix-synapse-1.43.0-1.1 on GA media 2026-10-05T22:25:03.916830+00:00

matrix-synapse-1.43.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2020-236 PYSEC-2020-236 2026-10-05T22:25:03.916868+00:00

Affected: PyPI: matrix-synapse

Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-26257 UBUNTU-CVE-2020-26257 2026-10-05T22:25:03.916919+00:00

Affected: Ubuntu:Pro:18.04:LTS: matrix-synapse, Ubuntu:Pro:20.04:LTS: matrix-synapse, Ubuntu:Pro:22.04:LTS: matrix-synapse

Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).