---
id: CVE-2020-26257
aliases:
  - GHSA-hxmp-pqch-c8mm
  - PYSEC-2020-236
title: Denial of service attack via incorrect parameters in Matrix Synapse
summary: Denial of service attack via incorrect parameters in Matrix Synapse
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: matrix-synapse
product: matrix-synapse
ecosystem: pip
affected:
  - matrix-synapse < 1.23.1
patched:
  - matrix-synapse 1.23.1
published: '2020-12-09'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:00.422107261Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hxmp-pqch-c8mm'
references:
  - url: >-
      https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-26257'
  - url: 'https://github.com/matrix-org/synapse/pull/8776'
  - url: >-
      https://github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b
  - url: >-
      https://github.com/matrix-org/synapse/blob/develop/CHANGES.md#synapse-1231-2020-12-09
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2020-236.yaml
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DBTIU3ZNBFWZ56V4X7JIAD33V5H2GOMC
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QR4MMYZKX5N5GYGH4H5LBUUC5TLAFHI7
tags:
  - osv
  - pip
epss: 0.02392
epssPercentile: 0.83085
ingestedAt: '2026-09-12T03:13:01.703Z'
---

## Overview

### Impact

A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request.

This can lead to a denial of service in which future events will not be correctly sent to other servers over federation.

This affects any server which accepts federation requests from untrusted servers.

### Patches

Issue is resolved by https://github.com/matrix-org/synapse/pull/8776.

### Workarounds

Homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).

## Affected packages

- `matrix-synapse < 1.23.1`

## Remediation

Upgrade to a patched release:

- `matrix-synapse 1.23.1`