CVE-2025-30355 is a critical vulnerability affecting Matrix Synapse homeservers up to version 1.127.0. A malicious server can send specially crafted events that disrupt federation, effectively isolating the vulnerable Synapse instance. With a CVSS score of 7.5 (High), this vulnerability requires no user interaction and can lead to a complete denial of service for federation capabilities. The flaw has been actively exploited in the wild, though no public exploit code or Metasploit modules are currently available. Community discussion is high, indicating significant awareness, and the issue has been addressed in Synapse v1.127.1, with no known workarounds for earlier versions.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.127.1CPE matchmatch criteria | cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.