When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | matrix-rust-sdk | before 0.6 | 0.6 | Patch available | CNA |
| — | matrix-sdk-crypto (crates.io) | before 0.6.0 | 0.6.0 | Patch available | GHSA-vp68-2wrm-69qm |
- matrix-rust-sdk Vendormatrix-org Affected before 0.6 Fixed in 0.6 Patch available CNA
- matrix-sdk-crypto (crates.io) Vendor— Affected before 0.6.0 Fixed in 0.6.0 Patch available GHSA-vp68-2wrm-69qm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix:matrix-rust-sdk:*:*:*:*:*:*:*:* | before 0.6 | Vulnerable | matrix-org |
- cpe:2.3:a:matrix:matrix-rust-sdk:*:*:*:*:*:*:*:* Versions before 0.6 Vulnerable ·matrix-org
Remediation
- Fix · CNA matrix-rust-sdk (matrix-org) Fixed in 0.6
- Fix · GHSA-vp68-2wrm-69qm matrix-sdk-crypto (crates.io) Fixed in 0.6.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-39252
- 2026-10-03 Alias added: GHSA-vp68-2wrm-69qm
- 2026-10-27 EPSS moved to the 50th–90th percentile
References
Patch 2
Advisory 3
More matrix-org Matrix-rust-sdk vulnerabilities
- TI-2025-41016 matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values CVSS 4.0LOW 1.3
Sources
- CVE-2022-39252 · CVE Program
- CVE-2022-39252 · NVD
- FIRST EPSS
- GHSA-vp68-2wrm-69qm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences