Today we are retroactively publishing advisories for security bugs in Synapse. From oldest to most recent, they are:

We strongly advise Synapse operators who are still on earlier Synapse versions to upgrade to the latest version (v1.84.0) or at the very least v1.74.0 (released Dec 2022), to prevent attacks based on these vulnerabilities. Please see the advisories for the full details, including a description of

  • the vulnerability and potential attacks,
  • exactly which deployments are vulnerable, and
  • workarounds and mitigations.

Because these bugs are either related to or exploitable over Matrix federation, we have delayed publishing these advisories until now out of caution. This allowed us to ensure that the majority of Synapse homeservers across the public federation have upgraded to a sufficiently patched version, based on the (opt-in) stats reporting to the foundation.

If you have any questions or comments about this announcement or any of the advisories, e-mail us at [email protected].

The Foundation needs you

The Foundation is a non-profit and only relies on donations to operate. Its core mission is to maintain the Matrix Specification, but it does much more than that.

It maintains the homeserver and hosts several bridges for free. It fights for our collective rights to digital privacy and dignity.

Support us