{"id":"CVE-2019-11340","aliases":["GHSA-q9h8-gpw5-c95c","PYSEC-2026-843"],"title":"Matrix Sydent mishandles emails","summary":"Matrix Sydent mishandles emails","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","vendor":"matrix-sydent","product":"matrix-sydent","ecosystem":"pip","affected":["matrix-sydent < 1.0.2"],"patched":["matrix-sydent 1.0.2"],"published":"2022-05-24","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-q9h8-gpw5-c95c","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11340"},{"url":"https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fc"},{"url":"https://github.com/matrix-org/sydent/compare/7c002cd...09278fb"},{"url":"https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2"},{"url":"https://twitter.com/matrixdotorg/status/1118934335963500545"}],"tags":["osv","pip"],"epss":0.01876,"epssPercentile":0.78486,"ingestedAt":"2026-07-08T18:25:52.378Z","slug":"CVE-2019-11340","body":"## Overview\n\nutil/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.\n\n## Affected packages\n\n- `matrix-sydent < 1.0.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-sydent 1.0.2`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}