PT-2022-4608 · Unknown+11 · Matrix-Js-Sdk+11
Dkasak
·
Published
2022-08-31
·
Updated
2025-09-29
·
CVE-2022-36059
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
matrix-js-sdk versions prior to 19.4.0
Description
The issue is related to errors in handling input data, which can allow a remote attacker to perform a denial-of-service (DoS) attack. Events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. The matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer.
Recommendations
For versions prior to 19.4.0, upgrade to version 19.4.0 to fix the issue.
For users unable to upgrade, redacting applicable events, waiting for the sync processor to store data, and restarting the client can often fix the issue.
Alternatively, redacting the applicable events and clearing all storage will often fix most perceived issues.
In some cases, no workarounds are possible.
Exploit
Fix
DoS
XSS
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Matrix-Js-Sdk