CVE-2025-49090: High severity matrix Matrix specification vulnerability
The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/synapseto a version that resolves this vulnerability.Fixed in 1.135.1-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49090?
CVE-2025-49090 is considered a critical vulnerability due to its impact on state resolution within the Matrix specification.
How do I fix CVE-2025-49090?
To fix CVE-2025-49090, upgrade to Matrix specification version 1.16 or higher.
What systems are affected by CVE-2025-49090?
CVE-2025-49090 affects all applications utilizing the Matrix specification before version 1.16.
What are the implications of CVE-2025-49090?
The implications of CVE-2025-49090 include potential unauthorized access to chat room states due to deficient state resolution.
Is there a workaround for CVE-2025-49090?
There are no known effective workarounds for CVE-2025-49090; upgrading to a secure version is recommended.