CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync`

What is CVE-2024-52815?

CVE-2024-52815 is a high-severity denial of service vulnerability in element-hq synapse, published on 3 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.

Weakness: CWE-20

Which versions are affected by CVE-2024-52815?

3 open source packages ship an affected version, including matrix-synapse. It affects 1 product.

Products include Matrix Synapse.

How do I fix CVE-2024-52815?

Upgrade matrix-synapse to 1.120.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-52815 being exploited?

There is no known exploitation of CVE-2024-52815 in the wild and no public exploit code.

Other vulnerabilities in element-hq synapse

• CVE-2019-18835 Improper Verification of Cryptographic Signature in matrix-synapse Critical 9.8
• CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion High 8.2
• CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders High 8.2
• CVE-2024-37302 Synapse denial of service through media disk space consumption High 7.5
• CVE-2018-12423 Matrix Synapse Authorization Error High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f3r3-h2mq-hx2h, PYSEC-2026-1611, UBUNTU-CVE-2024-52815.