{"id":"CVE-2020-26257","aliases":["GHSA-hxmp-pqch-c8mm","PYSEC-2020-236"],"title":"Denial of service attack via incorrect parameters in Matrix Synapse","summary":"Denial of service attack via incorrect parameters in Matrix Synapse","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","vendor":"matrix-synapse","product":"matrix-synapse","ecosystem":"pip","affected":["matrix-synapse < 1.23.1"],"patched":["matrix-synapse 1.23.1"],"published":"2020-12-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:00.422107261Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hxmp-pqch-c8mm","references":[{"url":"https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26257"},{"url":"https://github.com/matrix-org/synapse/pull/8776"},{"url":"https://github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b"},{"url":"https://github.com/matrix-org/synapse/blob/develop/CHANGES.md#synapse-1231-2020-12-09"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2020-236.yaml"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DBTIU3ZNBFWZ56V4X7JIAD33V5H2GOMC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QR4MMYZKX5N5GYGH4H5LBUUC5TLAFHI7"}],"tags":["osv","pip"],"epss":0.02392,"epssPercentile":0.83085,"ingestedAt":"2026-09-12T03:13:01.703Z","slug":"CVE-2020-26257","body":"## Overview\n\n### Impact\n\nA malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request.\n\nThis can lead to a denial of service in which future events will not be correctly sent to other servers over federation.\n\nThis affects any server which accepts federation requests from untrusted servers.\n\n### Patches\n\nIssue is resolved by https://github.com/matrix-org/synapse/pull/8776.\n\n### Workarounds\n\nHomeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).\n\n## Affected packages\n\n- `matrix-synapse < 1.23.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-synapse 1.23.1`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.5,"exploitation":0,"ransomware":0},"changes":[]}