GHSA-4ff6-858j-r822

Gomatrixserverlib Server-Side Request Forgery (SSRF) on redirects and federation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-52594

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/matrix-org/gomatrixserverlib	< 0.0.0-20250116181547-c4f1e01eab0d	0.0.0-20250116181547-c4f1e01eab0d

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. ### Patches c4f1e01eab0dd435709ad15463ed38a079ad6128 fixes this issue. ### Workarounds Use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access. ### References N/A

References

External links from the advisory. They lead to third-party sites.

https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822 web
https://nvd.nist.gov/vuln/detail/CVE-2024-52594 advisory
https://github.com/matrix-org/gomatrixserverlib/commit/c4f1e01eab0dd435709ad15463ed38a079ad6128 web
https://github.com/matrix-org/gomatrixserverlib package
https://pkg.go.dev/vuln/GO-2025-3396 web