GHSA-fh66-fcv5-jjfr

Synapse's invalid device keys degrade federation functionality

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-61672

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	matrix-synapse	< 1.138.3	1.138.3
PyPI	matrix-synapse	>= 1.139.0rc2, < 1.139.1	1.139.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. ### Patches Patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2. ### Workarounds The vulnerability can only be exploited by users registered on the victim homeserver.

References

External links from the advisory. They lead to third-party sites.