Vulnerabilidades de Matrix
CVEs publicadas que afetam produtos de Matrix: 4 registro(s), com severidade, exploração e correções.
CVE-2025-66622
Alta · 7.5
CWE-755 09/12/2025
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.
CVE-2025-54315
Alta · 7.1
CWE-837 02/10/2025
The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create…
The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.
CVE-2025-49090
Alta · 7.1
CWE-642 02/10/2025
The Matrix specification before 1.16 (i.e., with a room version before 12 and State…
The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.
CVE-2019-11340
Média · 5.9
CWE-20 19/04/2019
Matrix Sydent mishandles emails
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.