CVE-2024-52805: matrix synapse

csirt@kutim:~/threat-intel/cve/CVE-2024-52805

CVSS 7.5 · High EPSS 0,74%

Kerentanan Allocation of Resources Without Limits or Throttling pada matrix synapse. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.

Rincian

Terbit di NVD: 3 Desember 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-770: Allocation of Resources Without Limits or Throttling
EPSS (30 hari): 0,74% peluang dieksploitasi; lebih tinggi dari 53,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
matrix	synapse	Semua versi sebelum 1.120.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2 advisory vendor
https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518 issue tracking
https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609 issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.