Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be manually redacted instead. Since events are replicated to servers of other room members, the impact is not constrained to the server of the event sender.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | matrix-synapse (PyPI) | before 1.20.0 | 1.20.0 | Patch available | GHSA-4mp3-385r-v63f |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- matrix-synapse (PyPI) Vendor— Affected before 1.20.0 Fixed in 1.20.0 Patch available GHSA-4mp3-385r-v63f
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* | before 1.20.0 | Vulnerable | matrix-org |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* Versions before 1.20.0 Vulnerable ·matrix-org
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-4mp3-385r-v63f matrix-synapse (PyPI) Fixed in 1.20.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26890
- 2026-10-03 Alias added: GHSA-4mp3-385r-v63f
References
Advisory 3
Other 5
- https://github.com/matrix-org/synapse
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2020-237.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/G7YXMMYQP46PYL664JQUXCA3LPBJU7DQ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/U34DPP4ZLOEDUY2ZCWOHQPU5GA5LYNUQ
- https://pypi.org/project/matrix-synapse
Sources
- CVE-2020-26890 · CVE Program
- CVE-2020-26890 · NVD
- FIRST EPSS
- GHSA-4mp3-385r-v63f · GitHub Advisory Database · CC BY 4.0
- CVE-2020-26890 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences