ByteOS Network

NVD Vulnerability Details :

CVE-2025-30355

Analyzed

Source-security-advisories@github.com

Published At-27 Mar, 2025 | 01:15

Updated At-26 Aug, 2025 | 19:24

Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CPE Matches

The Matrix.org Foundation

>>synapse>>Versions before 1.127.1(exclusive)

cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	security-advisories@github.com
NVD-CWE-noinfo	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/element-hq/synapse/commit/2277df2a1eb685f85040ef98fa21d41aa4cdd389	security-advisories@github.com	Patch
https://github.com/element-hq/synapse/releases/tag/v1.127.1	security-advisories@github.com	Release Notes
https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6	security-advisories@github.com	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History