Vulnerability Intelligence Report
Synapse allows unsupported content types to lead to memory exhaustion
CVE-2024-52805
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
No Active Exploit Signals
CVSS Base Score
8.2
HIGH
EPSS Probability:0.70%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-770 ↗CWE-770: Allocation of Resources Without Limits or Throttling
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| element-hq | synapse | < 1.120.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.701%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2024-11-15T17:11:13 |
| Published | 2024-12-03T17:01:50 |
| Last Updated | 2024-12-03T19:04:44 |
Community Chatter & Buzz