CVE-2024-42369
MEDIUMmatrix-js-sdk < 34.3.1 - Denial of Service via Cyclic Room Structure
Title source: llmDescription
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm
Scores
CVSS v3
4.1
EPSS
0.0046
EPSS Percentile
35.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-674
Status
published
Products (2)
matrix/javascript_sdk
< 34.3.1
npm/matrix-js-sdk
0 - 34.3.1npm
Published
Aug 20, 2024
Tracked Since
Feb 18, 2026