CVE-2022-41952 json
Uncontrolled Resource Consumption in Matrix Synapse
published 2022-04-01 4 y ago modified 2026-07-06 4 mo ago also GHSA-4822-jvwx-w47h , PYSEC-2026-663 , EUVD-2022-1616
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. Upgrade to 1.53.0 to fully resolve the issue. As a workaround, turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file.
Patch / fix
- pypi matrix-synapse 1.53.0
- matrix synapse 1.53.0
- github.com/matrix-org/synapse#11784 pull request
- github.com/matrix-org/synapse#11936 pull request
- github.com/matrix-org/synapse/releases/tag/v1.52.0 release
- github.com/matrix-org/synapse/releases/tag/v1.53.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.94% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | matrix-synapse | <1.53.0 |
1.53.0 |
Affected products
- matrix-org synapse
Classification
References
-
github.com
/matrix-org/synapse/pull/11784
web, patch, third-party-advisory
-
github.com
/matrix-org/synapse/pull/11936
web, patch, third-party-advisory
-
github.com
/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47h
web, mitigation, third-party-advisory
-
github.com
/matrix-org/synapse/releases/tag/v1.52.0
web, release-notes, third-party-advisory
-
github.com
/matrix-org/synapse/releases/tag/v1.53.0
web, release-notes, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-41952
advisory
-
github.com
/matrix-org/synapse
package
-
pypi.org
/project/matrix-synapse
package
-
github.com
/advisories/GHSA-4822-jvwx-w47h
advisory
Sources
- CVE List CVE-2022-41952
- GitHub Advisory GHSA-4822-jvwx-w47h
- NVD CVE-2022-41952
- OSV PYSEC-2026-663
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.