Skip to content
Fencer Intel
medium 5.3

CVE-2024-52791 json

Denial of service through memory exhaustion in Matrix Media Repo

published last yr. modified 4mo ago also GHSA-gp86-q8hg-fpxj , GO-2025-3398 , EUVD-2025-0098

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part of normal operation, and these resource owners can return large amounts of JSON back to MMR for parsing. In parsing, MMR can consume large amounts of memory and exhaust available memory. This is fixed in MMR v1.3.8. Users are advised to upgrade. For users unable to upgrade; forward proxies can be configured to block requests to unsafe hosts. Alternatively, MMR processes can be configured with memory limits and auto-restart. Running multiple MMR processes concurrently can help ensure a restart does not overly impact users.

Patch / fix

  • go github.com/t2bot/matrix-media-repo 1.3.8
  • t2bot matrix-media-repo 1.3.8
  • govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250128T150132-150000.1.29.1

suse advisories SUSE-SU-2025:0297-1

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250117T214834-1.1

opensuse advisories openSUSE-SU-2025:14704-1

Is CVE-2024-52791 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
go github.com/t2bot/matrix-media-repo
<1.3.8
1.3.8

Affected products

  • t2bot matrix-media-repo

Classification

Weakness
  • CWE-789 Memory Allocation with Excessive Size Value

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.