PT-2025-41273 · Synapse · Synapse

Dkasak · Published 2025-10-07 · Updated 2025-10-08 · CVE-2025-61672

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.138.3 Synapse version 1.139.0

Description Synapse is an open source Matrix homeserver implementation. Insufficient validation of device keys in affected versions allows an attacker registered on the victim homeserver to disrupt federation functionality, potentially breaking outbound federation to other homeservers.

Recommendations Upgrade to Synapse version 1.138.4 or later. Upgrade to Synapse version 1.139.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-1287

Related Identifiers

CVE-2025-61672

GHSA-FH66-FCV5-JJFR

OPENSUSE-SU-2025:15603-1

Affected Products

Synapse

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61672.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-61672 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61672 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15603-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61672 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-61672 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61672 · Security Note
• https://osv.dev/vulnerability/GHSA-fh66-fcv5-jjfr · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61672 · Vendor Advisory
• https://github.com/element-hq/synapse · Note
• https://github.com/element-hq/synapse/releases/tag/v1.139.2 · Note
• https://github.com/element-hq/synapse/releases/tag/v1.138.4 · Note
• https://github.com/element-hq/synapse/pull/17097 · Note
• https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr · Note