CVE-2025-61672Medium▾ SunlitSynapse's invalid device keys degrade federation functionality
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
0.4% → 0.5%
Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers.
Patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2.
Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2.
The vulnerability can only be exploited by users registered on the victim homeserver.
matrix-synapse < 1.138.3matrix-synapse >= 1.139.0rc2, < 1.139.1Upgrade to a patched release:
matrix-synapse 1.138.3matrix-synapse 1.139.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45078Medium· 5.5Synapse CPU starvation (Denial of Service)
CVE-2026-45076MediumSynapse pagination Denial of Service
CVE-2024-31208Medium· 6.5Synapse V2 state resolution weakness allows Denial of Service (DoS)
CVE-2024-53863HighSynapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
CVE-2025-30355High· 7.1Synapse vulnerable to federation denial of service via malformed events
CVE-2024-52805HighSynapse allows unsupported content types to lead to memory exhaustion