CVE-2024-52805 HIGH

CVE-2024-52805: Synapse allows unsupported content types to lead to memory exhaustion

Vendor Element-Hq
Product synapse
Weakness CWE-770 · Uncontrolled resource consumption
Published December 3, 2024
Last update December 3, 2024

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.

Key dates

02Disclosure timeline

December 3, 2024 CVE published
December 3, 2024 Record updated