CVE-2025-30355

HIGH

Synapse vulnerable to federation denial of service via malformed events

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-30355 has a selected CVSS score of 7.1 (high).

Description

Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 26, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 27, 2025 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Synapse

Browse Element / Synapse
VulnCheckVersion data not supplied

synapse

Browse element-hq / synapse
CVE List< 1.127.1affected

matrix-synapse

Browse PyPI / matrix-synapse
GitHub AdvisoryBefore 1.127.1 · Fixed in 1.127.1affected

References

5