https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:04:28.655896+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-52815 CVE-2024-52815 — Synapse allows a a malformed invite to break the invitee's `/sync` 2026-10-03T09:04:28.694730+00:00

Affected: element-hq synapse

Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.

 https://cve.radiocsirt.org/vuln/ghsa-f3r3-h2mq-hx2h GHSA-f3r3-h2mq-hx2h — Synapse allows a a malformed invite to break the invitee's `/sync` 2026-10-03T09:04:28.694790+00:00

Affected: PyPI: matrix-synapse

### Impact

Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's `/sync` functionality.

### Patches

Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.

### Workarounds

Server administrators can disable federation from untrusted servers.

### For more information

If you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).