{"id":"CVE-2024-52815","aliases":["GHSA-f3r3-h2mq-hx2h","PYSEC-2026-1611"],"title":"Synapse allows a a malformed invite to break the invitee's `/sync`","summary":"Synapse allows a a malformed invite to break the invitee's `/sync`","severity":"high","vendor":"matrix-synapse","product":"matrix-synapse","ecosystem":"pip","affected":["matrix-synapse < 1.120.1"],"patched":["matrix-synapse 1.120.1"],"published":"2024-12-03","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-f3r3-h2mq-hx2h","references":[{"url":"https://github.com/element-hq/synapse/security/advisories/GHSA-f3r3-h2mq-hx2h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52815"},{"url":"https://github.com/element-hq/synapse"}],"tags":["osv","pip"],"epss":0.0057,"epssPercentile":0.45943,"ingestedAt":"2026-07-08T18:25:48.630Z","slug":"CVE-2024-52815","body":"## Overview\n\n### Impact\n\nSynapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's `/sync` functionality.\n\n### Patches\n\nSynapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.\n\n### Workarounds\n\nServer administrators can disable federation from untrusted servers.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).\n\n\n## Affected packages\n\n- `matrix-synapse < 1.120.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-synapse 1.120.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}