CVE-2025-66622

Katalog CVE

CVSS 7.5 · High EPSS 0,41%

Kerentanan Improper Handling of Exceptional Conditions pada matrix-rust-sdk. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.

Rincian

Terbit di NVD

9 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3 patch · advisory vendor
• https://github.com/matrix-org/matrix-rust-sdk/commit/4ea0418abefab2aa93f8851a4d39c723e703e6b0 patch
• https://github.com/matrix-org/matrix-rust-sdk/pull/5924 issue tracking · patch
• https://rustsec.org/advisories/RUSTSEC-2025-0135.html advisory pihak ketiga