Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Matrix Synapse before 1.20.0 allows denial of service attacks

CVE-2020-26890 · published 5 years ago
Summary

If an attacker sends a special kind of message to a chat room, it can cause problems for other users and their servers. The issue is not fixed by updating the software, so administrators will need to manually remove the problematic message. This means that all servers storing a copy of the chat will be affected.

What to do
  • Update matrix.org team and contributors matrix-synapse to version 1.20.0.
  • Update debian matrix-synapse to version 1.20.0-1.
  • Update matrix synapse to version 1.20.0 or later.
Affected software
Ecosystem VendorProductAffected versions
pip matrix.org team and contributors matrix-synapse < 1.20.0
Fix: upgrade to 1.20.0
– matrix synapse < 1.20.0
cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*
– fedoraproject fedora 32
33
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Debian:14 debian matrix-synapse < 1.20.0-1
Fix: upgrade to 1.20.0-1
Original advisory text
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service at...
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be manually redacted instead. Since events are replicated to servers of other room members, the impact is not constrained to the server of the event sender.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.7 High
Exploitation
3% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published24 Nov 2020
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-4mp3-385r-v63f · GHSA
CVE-2020-26890 · NVD
DEBIAN-CVE-2020-26890 · OSV
Track software like this
Free during beta