PT-2025-49576 · Unknown · Matrix-Sdk-Base

Published 2025-12-08 · Updated 2025-12-09 · CVE-2025-66622

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions matrix-sdk-base versions 0.14.1 and prior

Description The software is susceptible to a denial-of-service condition. If a user is invited to a room with non-standard join rules, the sync process will stall, preventing further processing for all rooms. This is due to an inability to handle responses that include custom m.room.join rules values, caused by a serialization bug.

Recommendations Update to version 0.16.0 or later.

Exploit

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2025-66622

GHSA-JJ6P-3M75-G2P3

RUSTSEC-2025-0135

Affected Products

Matrix-Sdk-Base

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66622.json · Exploit
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3 · Vendor Advisory
• https://github.com/matrix-org/matrix-rust-sdk/commit/4ea0418abefab2aa93f8851a4d39c723e703e6b0 · Patch
• https://github.com/matrix-org/matrix-rust-sdk/pull/5924 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66622 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2025-0135 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66622 · Vendor Advisory
• https://twitter.com/CVEnew/status/1998225343778582759 · Twitter Post
• https://t.me/CVEtracker/39190 · Telegram Post
• https://crates.io/crates/matrix-sdk-base · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0135.html · Note