CVE-2025-30355: Synapse vulnerable to federation denial of service via malformed events
Impact A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild.
Patches Fixed in Synapse v1.127.1.
Workarounds Closed federation environments of trusted servers or non-federating installations are not affected.
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Other sources
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/matrix-synapseto a version that resolves this vulnerability.Fixed in 1.127.1 - Upgrade
Upgrade
Synapseto a version that resolves this vulnerability.Fixed in 1.127.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30355?
CVE-2025-30355 is classified as a high severity vulnerability due to its potential to disrupt federated communications in Synapse.
How do I fix CVE-2025-30355?
To fix CVE-2025-30355, update Synapse to version 1.127.1 or later.
What versions of Synapse are affected by CVE-2025-30355?
CVE-2025-30355 affects Synapse versions up to and including 1.127.0.
What are the implications of CVE-2025-30355 being exploited?
If exploited, CVE-2025-30355 can prevent a Synapse server from federating with other servers, disrupting communication.
Is there ongoing support for my version due to CVE-2025-30355?
Support for versions affected by CVE-2025-30355 is limited, and upgrading is strongly recommended to ensure security.