Read the docs
TI-2024-24814 Aliases CVE-2024-37302GHSA-4mhg-xv73-xq2x

Synapse denial of service through media disk space consumption

Priority MEDIUM 40CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00596 48th percentileScored 2026-11-07
Fix Fixed synapse (element-hq): 1.106matrix-synapse (PyPI): 1.106

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
element-hqsynapsebefore 1.1061.106Patch availableCNA
—matrix-synapse (PyPI)before 1.1061.106Patch availableGHSA-4mhg-xv73-xq2x
  • synapse Vendorelement-hq Affected before 1.106 Fixed in 1.106 Patch available CNA
  • matrix-synapse (PyPI) Vendor— Affected before 1.106 Fixed in 1.106 Patch available GHSA-4mhg-xv73-xq2x

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*before 1.106.0Vulnerablematrix-org
  • cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* Versions before 1.106.0 Vulnerable ·matrix-org

Remediation

  • Fix · CNA synapse (element-hq) Fixed in 1.106
  • Fix · GHSA-4mhg-xv73-xq2x matrix-synapse (PyPI) Fixed in 1.106 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-37302
  2. 2026-10-03 Alias added: GHSA-4mhg-xv73-xq2x

References

Advisory 2

Other 2

  • TI-2024-35327 Synapse allows a a malformed invite to break the invitee's `/sync` CVSS 4.0HIGH 8.7
  • TI-2024-36056 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVSS 4.0HIGH 8.2
  • TI-2024-35318 Synapse allows unsupported content types to lead to memory exhaustion CVSS 4.0HIGH 8.2
  • TI-2022-07650 Remote program execution with user interaction CVSS 3.1HIGH 8.8
  • TI-2026-19372 ESS Community Helm Chart has a weak server key generation method CVSS 4.0CRITICAL 9.2
  • TI-2026-35452 Element Call reports full URLs of visited pages to analytics server CVSS 4.0HIGH 8.6
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences