{"id":"CVE-2024-52805","aliases":["GHSA-rfq8-j7rh-8hf2","PYSEC-2026-1613"],"title":"Synapse allows unsupported content types to lead to memory exhaustion","summary":"Synapse allows unsupported content types to lead to memory exhaustion","severity":"high","vendor":"matrix-synapse","product":"matrix-synapse","ecosystem":"pip","affected":["matrix-synapse < 1.120.1"],"patched":["matrix-synapse 1.120.1"],"published":"2024-12-03","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-rfq8-j7rh-8hf2","references":[{"url":"https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52805"},{"url":"https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518"},{"url":"https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609"},{"url":"https://github.com/element-hq/synapse"}],"tags":["osv","pip"],"epss":0.00739,"epssPercentile":0.53125,"ingestedAt":"2026-07-08T18:25:52.709Z","slug":"CVE-2024-52805","body":"## Overview\n\n### Impact\n\nIn Synapse before 1.120.1, `multipart/form-data` requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks.\n\n### Patches\n\nSynapse 1.120.1 resolves the issue by denying requests with unsupported `multipart/form-data` content type.\n\n### Workarounds\n\nLimiting request sizes or blocking the `multipart/form-data` content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low `max_upload_size` in Synapse.\n\n### References\n\n- https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518\n- https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).\n\n\n## Affected packages\n\n- `matrix-synapse < 1.120.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-synapse 1.120.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}