Description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| matrix-org | synapse | < 1.33.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | matrix-synapse | No fix yet | — |
| Ubuntu Pro 20.04 LTS | matrix-synapse | No fix yet | — |
| Ubuntu Pro 18.04 LTS | matrix-synapse | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | matrix-synapse | 1.43.0-1.1 | openSUSE-SU-2024:11041-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | synapse | 1.33.2-r0 | — |
| Alpine v3.23 | synapse | 1.33.2-r0 | — |
| Alpine v3.22 | synapse | 1.33.2-r0 | — |
| Alpine v3.21 | synapse | 1.33.2-r0 | — |
| Alpine v3.20 | synapse | 1.33.2-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | synapse | 1.33.2-r0 | — |
| Alpine v3.18 | synapse | 1.33.2-r0 | — |
| Alpine v3.17 | synapse | 1.33.2-r0 | — |
| Alpine v3.16 | synapse | 1.33.2-r0 | — |
| Alpine v3.15 | synapse | 1.33.2-r0 | — |
| Alpine v3.14 | synapse | 1.33.2-r0 | — |
| Alpine v3.13 | synapse | 1.34.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | matrix-synapse | < 1.33.2 | 1.33.2 | GHSA-x345-32rc-8h85 |
Advisories 1
- openSUSE-SU-2024:11041-1 matrix-synapse-1.43.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026