CVE-2018-10657 Matrix Synapse DoS
Attackers can cause denial of service in Matrix Synapse by injecting malicious events with extreme depth values, rendering rooms unusable.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10657?
CVE-2018-10657 is a high-severity denial of service vulnerability in n/a, published on 2 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py, as exploited in the wild in April 2018.
Weakness: CWE-20
Which versions are affected by CVE-2018-10657?
3 open source packages ship an affected version, including matrix-synapse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | All versions | 0.28.1 |
matrix-synapse PyPI | All versions | 0.28.1 |
matrix-synapse PyPI | All versions | 0.28.1 |
Products include Matrix Synapse.
How do I fix CVE-2018-10657?
Upgrade matrix-synapse to 0.28.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-10657 being exploited?
There is no known exploitation of CVE-2018-10657 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-18835 Improper Verification of Cryptographic Signature in matrix-synapse
- CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync`
- CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion
- CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
- CVE-2024-37302 Synapse denial of service through media disk space consumption
Sources
Also known as GHSA-vmcc-4p4x-x7wg, PYSEC-2026-846, UBUNTU-CVE-2018-10657.