{"id":"CVE-2018-10657","aliases":["GHSA-vmcc-4p4x-x7wg","PYSEC-2026-846"],"title":"Matrix Synapse DoS","summary":"Matrix Synapse DoS","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"matrix-synapse","product":"matrix-synapse","ecosystem":"pip","affected":["matrix-synapse < 0.28.1"],"patched":["matrix-synapse 0.28.1"],"published":"2022-05-14","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vmcc-4p4x-x7wg","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10657"},{"url":"https://github.com/matrix-org/synapse/commit/33f469ba19586bbafa0cf2c7d7c35463bdab87eb"},{"url":"https://docs.google.com/document/d/1I3fi2S-XnpO45qrpCsowZv8P8dHcNZ4fsBsbOW7KABI/edit#heading=h.fj95ykuss7s1"},{"url":"https://github.com/matrix-org/synapse"},{"url":"https://matrix.org/blog/2018/05/01/security-update-synapse-0-28-1"}],"tags":["osv","pip","in-the-wild"],"epss":0.01454,"epssPercentile":0.71889,"exploited":true,"zeroDay":true,"ingestedAt":"2026-07-08T18:25:53.343Z","slug":"CVE-2018-10657","body":"## Overview\n\nMatrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2<sup>63</sup> - 1 render rooms unusable, related to `federation/federation_base.py` and `handlers/message.py`, as exploited in the wild in April 2018.\n\n## Affected packages\n\n- `matrix-synapse < 0.28.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-synapse 0.28.1`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":25,"ransomware":0},"changes":[]}