Vulnerability Database
296,676
Total vulnerabilities in the database
CVE-2025-61672
Impact
Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers.
Patches
Patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2.
Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2.
Workarounds
The vulnerability can only be exploited by users registered on the victim homeserver.
| Software | From | Fixed in |
|---|---|---|
matrix-synapse
|
- | 1.138.3 |
|
matrix-synapse
|
1.139.0rc2 | 1.139.1 |
- https://github.com/element-hq/synapse/commit/26aaaf9e48fff80cf67a20c691c75d670034b3c1
- https://github.com/element-hq/synapse/commit/7069636c2d6d1ef2022287addf3ed8b919ef2740
- https://github.com/element-hq/synapse/pull/17097
- https://github.com/element-hq/synapse/releases/tag/v1.138.3
- https://github.com/element-hq/synapse/releases/tag/v1.138.4
- https://github.com/element-hq/synapse/releases/tag/v1.139.1
- https://github.com/element-hq/synapse/releases/tag/v1.139.2
- https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime