{"id":"CVE-2023-45129","aliases":["GHSA-5chr-wjw5-3gq4","PYSEC-2023-199"],"title":"matrix-synapse vulnerable to denial of service due to malicious server ACL events","summary":"matrix-synapse vulnerable to denial of service due to malicious server ACL events","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","vendor":"matrix-synapse","product":"matrix-synapse","ecosystem":"pip","affected":["matrix-synapse < 1.94.0"],"patched":["matrix-synapse 1.94.0"],"published":"2023-10-10","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:58.536596047Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-5chr-wjw5-3gq4","references":[{"url":"https://github.com/matrix-org/synapse/security/advisories/GHSA-5chr-wjw5-3gq4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45129"},{"url":"https://github.com/matrix-org/synapse/pull/16360"},{"url":"https://github.com/matrix-org/synapse/commit/f84da3c32ec74cf054e2fd6d10618aa4997cffaa"},{"url":"https://github.com/matrix-org/synapse"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-199.yaml"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEVRB4MG5UXQ5RLZHSUJXM5GWEBYYS5B"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WRO4MPQ6HOXIUZM6RJP6VTCTMV7RD2T3"},{"url":"https://matrix-org.github.io/synapse/latest/admin_api/rooms.html#version-2-new-version"},{"url":"https://security.gentoo.org/glsa/202401-12"}],"tags":["osv","pip"],"epss":0.01166,"epssPercentile":0.65469,"ingestedAt":"2026-09-12T03:13:01.659Z","slug":"CVE-2023-45129","body":"## Overview\n\n### Impact\nA malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service.\n\nHomeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected.\n\n### Patches\nServer administrators are advised to upgrade to Synapse 1.94.0 or later.\n\n### Workarounds\nRooms with malicious server ACL events can be [purged and blocked](https://matrix-org.github.io/synapse/latest/admin_api/rooms.html#version-2-new-version) using the admin API.\n\n\n## Affected packages\n\n- `matrix-synapse < 1.94.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-synapse 1.94.0`","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}