Start your free trial today.

Protect your organization with cutting-edge cybersecurity solutions designed for resilience and efficiency. Secure your digital assets with confidence.

Your Shield Against Threats

Unleash the Power of Cybersecurity

Boost Your Security, Enhance Your Business

We solve Your Cyber Challenges

Quick Links

Resources

Deepaegis Portals

CVE-2025-30355

CVSS SCORE:7.1

CVE ID:CVE-2025-30355

SEVERITY:High

Vendor:Unknown Vendor

Reporter:security-advisories@github.com

Exploitable?Yes

Summary

Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.

CVSS Metrics

Source: security-advisories@github.com

version3.1

vectorStringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

baseScore7.1

baseSeverityHIGH

attackVectorNETWORK

attackComplexityLOW

privilegesRequiredLOW

userInteractionNONE

scopeUNCHANGED

confidentialityImpactNONE

integrityImpactLOW

availabilityImpactHIGH

CWE Information

Source: security-advisories@github.com,Type: Primary

Source: nvd@nist.gov,Type: Primary

Additional Information

References

security-advisories@github.com:https://github.com/element-hq/synapse/commit/2277df2a1eb685f85040ef98fa21d41aa4cdd389

security-advisories@github.com:https://github.com/element-hq/synapse/releases/tag/v1.127.1

security-advisories@github.com:https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6

Affected Organizations

No affected organizations specified

Confidentiality Notice

This document contains sensitive information. Unauthorized distribution is prohibited.

Vulnerability Advisory

Published 3/27/2025

Updated 8/26/2025