CVE-2025-61672: Synapse: Invalid device keys degrade federation functionality
Impact
Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers.
Patches
Patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2.
Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2.
Workarounds
The vulnerability can only be exploited by users registered on the victim homeserver.
Other sources
Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61672?
CVE-2025-61672 is considered a moderate severity vulnerability due to its potential to disrupt federation functionality.
How do I fix CVE-2025-61672?
To mitigate CVE-2025-61672, upgrade your Synapse installation to version 1.138.3 or later.
Who is affected by CVE-2025-61672?
CVE-2025-61672 affects users of Synapse versions before 1.138.3 and version 1.139.0.
What are the implications of CVE-2025-61672?
Exploitation of CVE-2025-61672 allows an attacker to degrade federation functionality, causing issues with outbound federation.
Is there a workaround for CVE-2025-61672?
Currently, the recommended solution for CVE-2025-61672 is to apply the available updates rather than relying on workarounds.