Uncontrolled Resource Consumption in Matrix Synapse
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. Upgrade to 1.53.0 to fully resolve the issue. As a workaround, turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | synapse | before 1.53.0 | 1.53.0 | Patch available | CNA |
| — | matrix-synapse (PyPI) | before 1.53.0 | 1.53.0 | Patch available | GHSA-4822-jvwx-w47h |
- synapse Vendormatrix-org Affected before 1.53.0 Fixed in 1.53.0 Patch available CNA
- matrix-synapse (PyPI) Vendor— Affected before 1.53.0 Fixed in 1.53.0 Patch available GHSA-4822-jvwx-w47h
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* | before 1.53.0 | Vulnerable | matrix-org |
- cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* Versions before 1.53.0 Vulnerable ·matrix-org
Remediation
- Fix · CNA synapse (matrix-org) Fixed in 1.53.0
- Fix · GHSA-4822-jvwx-w47h matrix-synapse (PyPI) Fixed in 1.53.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41952
- 2026-10-03 Alias added: GHSA-4822-jvwx-w47h
References
Patch 2
Advisory 4
More matrix-org Synapse vulnerabilities
- TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
- TI-2024-35327 Synapse allows a a malformed invite to break the invitee's `/sync` CVSS 4.0HIGH 8.7
- TI-2019-13571 Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. CVSS 3.1CRITICAL 9.8
- TI-2024-36056 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVSS 4.0HIGH 8.2
- TI-2024-35318 Synapse allows unsupported content types to lead to memory exhaustion CVSS 4.0HIGH 8.2
- TI-2018-11846 Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have… CVSS 3.0HIGH 8.8
Sources
- CVE-2022-41952 · CVE Program
- CVE-2022-41952 · NVD
- FIRST EPSS
- GHSA-4822-jvwx-w47h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences