CVE-2025-30355
📋 TL;DR
A malicious Matrix server can craft events that cause Synapse homeservers to stop federating with other servers when received. This denial-of-service vulnerability affects all Synapse servers up to version 1.127.0 that participate in Matrix federation. The vulnerability has been actively exploited in the wild.
💻 Affected Systems
- Synapse Matrix homeserver
📦 What is this software?
Synapse by Matrix
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of federation capabilities, isolating the Synapse server from the Matrix network and preventing communication with other servers.
Likely Case
Temporary or permanent federation outages requiring server restart or patching to restore functionality.
If Mitigated
Limited impact if server is restarted quickly, but federation remains vulnerable until patched.
🎯 Exploit Status
Requires a malicious server to send crafted events to the target. Exploitation has been observed in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.127.1
Vendor Advisory: https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6
Restart Required: No
Instructions:
1. Backup your Synapse configuration and database. 2. Update Synapse using your package manager or pip: 'pip install --upgrade matrix-synapse==1.127.1'. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
No workarounds available
allThe vendor advisory states no known workarounds exist for this vulnerability.
🧯 If You Can't Patch
- Monitor federation logs closely for unusual activity and restart Synapse if federation stops
- Consider temporarily disabling federation if critical services are affected
🔍 How to Verify
Check if Vulnerable:
Check Synapse version: if running version 1.127.0 or earlier, the system is vulnerable.Check Version:
synctl --version or check /usr/local/lib/python3.X/site-packages/synapse/__init__.pyVerify Fix Applied:
Verify Synapse is running version 1.127.1 or later and federation is functioning normally.📡 Detection & Monitoring
Log Indicators:
- Unexpected federation errors
- Server stops processing federation events
- Increased error rates in federation logs
Network Indicators:
- Sudden drop in federation traffic
- Failed federation connections
SIEM Query:
source="synapse.log" AND ("federation error" OR "failed to process" OR "unexpected event")