PT-2024-27460 · Matrix · Synapse

Published 2024-12-03 · Updated 2025-08-26 · CVE-2024-37302

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.106

Description Synapse is an open-source Matrix homeserver. The issue allows an unauthenticated adversary to induce Synapse to download and cache large amounts of remote media, leading to a denial of service. This can range from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time, limiting an unauthenticated user's ability to request large amounts of data to be cached.

Recommendations For Synapse versions prior to 1.106, consider decreasing the maximum file size allowed and increasing request rate limits as a temporary workaround. Additionally, server operators may wish to put media on a dedicated disk or volume to reduce the impact of a disk fill condition. To fully address the issue, update to Synapse version 1.106 or later, which introduces the new "leaky bucket" rate limit on remote media downloads.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-37302

GHSA-4MHG-XV73-XQ2X

OPENSUSE-SU-2024:14541-1

PYSEC-2024-286

Affected Products

Synapse

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37302.json · Exploit
• https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37302 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14541-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-37302 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-37302 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37302 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-37302 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-37302 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-37302 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4mhg-xv73-xq2x · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-286 · Vendor Advisory
• https://github.com/element-hq/synapse · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2024-286.yaml · Note
• https://suse.com/security/cve/CVE-2024-37302 · Note