CVE-2025-61672mediumCWE-1287

CVE-2025-61672: fallo de gravedad media en element-hq synapse

Synapse: Invalid device keys degrade federation functionality

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear synapse+ Monitorear matrix-synapse

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.5%
Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
element-hq · synapse
CVEs relacionadas — element-hq synapse

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-31208MEDIUMSynapse's V2 state resolution weakness allows DoS from remote room membersEPSS 1.5%CVE-2025-30355HIGHSynapse vulnerable to federation denial of service via malformed eventsEPSS 1.2%CVE-2024-52805HIGHSynapse allows unsupported content types to lead to memory exhaustionEPSS 0.7%CVE-2024-53863HIGHSynapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decodersEPSS 0.6%CVE-2024-37302HIGHSynapse denial of service through media disk space consumptionEPSS 0.6%CVE-2024-52815HIGHSynapse allows a a malformed invite to break the invitee's `/sync`EPSS 0.6%