CVE-2024-52805: falha de alta gravidade em element-hq synapse
Synapse allows unsupported content types to lead to memory exhaustion
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.7%
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
element-hq · synapseCVEs relacionadas — element-hq synapse
No mesmo produto, das mais perigosas para as menos.
CVE-2024-31208MEDIUMSynapse's V2 state resolution weakness allows DoS from remote room membersEPSS 1.5%CVE-2025-30355HIGHSynapse vulnerable to federation denial of service via malformed eventsEPSS 1.2%CVE-2024-53863HIGHSynapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decodersEPSS 0.6%CVE-2024-37302HIGHSynapse denial of service through media disk space consumptionEPSS 0.6%CVE-2024-52815HIGHSynapse allows a a malformed invite to break the invitee's `/sync`EPSS 0.6%CVE-2025-61672MEDIUMSynapse: Invalid device keys degrade federation functionalityEPSS 0.5%