Skip to content
Fencer Intel
medium 6.5

CVE-2020-26257 json

Denial of service attack via incorrect parameters to federation APIs

published 2020-12-09 5 y ago modified 2026-09-10 1 mo ago also GHSA-hxmp-pqch-c8mm , PYSEC-2020-236 , EUVD-2020-0106

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).

Patch / fix

  • pypi matrix-synapse 1.23.1
  • matrix synapse 1.23.1
  • matrix-synapse openSUSE Tumbleweed 1.43.0-1.1

opensuse advisories openSUSE-SU-2024:11041-1

  • synapse Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.24.0-r0

alpine advisories ALPINE-CVE-2020-26257

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • matrix-synapse Arch Linux 1.24.0-1

arch linux advisories AVG-1341

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-26257 updated cvss 6.5

matrix-synapse: incorrect parameters could result in DoS

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.39% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi matrix-synapse
<1.23.1
1.23.1

Affected products

  • matrix-org synapse

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-79 Improper Neutralization of Input During Web Page Generation
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.