PT-2025-13021 · Synapse · Synapse

Davidegirardi · Published 2025-03-26 · Updated 2025-08-26 · CVE-2025-30355

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.127.1

Description The issue allows a malicious server to craft events that prevent Synapse from federating with other servers. The vulnerability has been exploited in the wild.

Recommendations For versions prior to 1.127.1, upgrade to Synapse v1.127.1 to resolve the issue.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-30355

GHSA-V56R-HWV5-MXG6

OPENSUSE-SU-2025:14939-1

Affected Products

Synapse

References · 37

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30355.json · Exploit
• https://github.com/element-hq/synapse/commit/2277df2a1eb685f85040ef98fa21d41aa4cdd389 · Patch
• https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-30355 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v56r-hwv5-mxg6 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-30355 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14939-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-30355 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30355 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-30355 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-30355 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-30355 · Security Note
• https://github.com/element-hq/synapse · Note
• https://github.com/element-hq/synapse/releases/tag/v1.127.1 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/BMJS2YEFBSOJRCOH6GFYZZHGJUCSI6ZU · Note