CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion

What is CVE-2024-52805?

CVE-2024-52805 is a high-severity denial of service vulnerability in element-hq synapse, published on 3 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.

Weakness: CWE-770

Which versions are affected by CVE-2024-52805?

3 open source packages ship an affected version, including matrix-synapse. It affects 1 product.

Products include Matrix Synapse.

How do I fix CVE-2024-52805?

Upgrade matrix-synapse to 1.120.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-52805 being exploited?

There is no known exploitation of CVE-2024-52805 in the wild and no public exploit code.

Other vulnerabilities in element-hq synapse

• CVE-2019-18835 Improper Verification of Cryptographic Signature in matrix-synapse Critical 9.8
• CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync` High 8.7
• CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders High 8.2
• CVE-2024-37302 Synapse denial of service through media disk space consumption High 7.5
• CVE-2018-12423 Matrix Synapse Authorization Error High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rfq8-j7rh-8hf2, PYSEC-2026-1613, UBUNTU-CVE-2024-52805.