CVE-2025-30355: Matrix Synapse DOS Vulnerability

CVE-2025-30355 Overview

CVE-2025-30355 is a Denial of Service vulnerability affecting Matrix Synapse, an open source Matrix homeserver implementation. A malicious server can craft specially designed events which, when received by vulnerable Synapse instances (versions up to 1.127.0), prevent the server from federating with other Matrix servers. This vulnerability has been exploited in the wild, disrupting Matrix federation capabilities for affected organizations.

Critical Impact

Malicious actors can disrupt Matrix federation by sending crafted events, effectively isolating affected Synapse homeservers from the broader Matrix network and causing communication outages.

Affected Products

• Matrix Synapse versions up to and including 1.127.0
• All Matrix homeserver deployments running vulnerable Synapse versions
• Federated Matrix networks with unpatched Synapse instances

Discovery Timeline

• 2025-03-27 - CVE-2025-30355 published to NVD
• 2025-08-26 - Last updated in NVD database

Technical Details for CVE-2025-30355

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in how Synapse processes event depth values during federation. The root cause relates to integer handling inconsistencies between Synapse's internal representation and the canonical JSON specification used for Matrix federation.

The vulnerability allows a malicious federated server to craft events with specially constructed depth values that exceed the bounds acceptable by canonical JSON processing. When a vulnerable Synapse instance receives these malformed events, it experiences processing failures that prevent proper federation with other Matrix servers.

This attack can be executed remotely without authentication, requiring only the ability to send federation traffic to the target homeserver. The impact is limited to availability—there is no confidentiality breach or data integrity compromise, but the denial of federation capability can severely disrupt Matrix communications.

Root Cause

The vulnerability exists due to a mismatch in how the maximum depth value for events was defined. Originally, Synapse allowed depth values up to 2**63 - 1, which exceeds the maximum safe integer value in canonical JSON (2**53 - 1). When events with depth values outside the canonical JSON range were processed, it caused federation failures.

Attack Vector

A malicious Matrix server participating in federation can craft and send events with depth field values that fall outside the acceptable range for canonical JSON processing. Since federation occurs over the network without requiring authentication from the perspective of the receiving server (federation is server-to-server authenticated), any malicious homeserver can exploit this vulnerability against unpatched Synapse instances.

# Security patch in synapse/api/constants.py
# Source: https://github.com/element-hq/synapse/commit/2277df2a1eb685f85040ef98fa21d41aa4cdd389

 # the max size of a (canonical-json-encoded) event
 MAX_PDU_SIZE = 65536
 
-# the "depth" field on events is limited to 2**63 - 1
-MAX_DEPTH = 2**63 - 1
+# Max/min size of ints in canonical JSON
+CANONICALJSON_MAX_INT = (2**53) - 1
+CANONICALJSON_MIN_INT = -CANONICALJSON_MAX_INT
+
+# the "depth" field on events is limited to the same as what
+# canonicaljson accepts
+MAX_DEPTH = CANONICALJSON_MAX_INT
 
 # the maximum length for a room alias is 255 characters
 MAX_ALIAS_LENGTH = 255

The patch aligns Synapse's maximum depth value with canonical JSON integer limits, preventing malformed events from disrupting federation.

Detection Methods for CVE-2025-30355

Indicators of Compromise

• Unexpected federation failures with specific Matrix homeservers
• Log entries indicating event processing errors related to depth values or integer bounds
• Sudden loss of federation connectivity with multiple remote Matrix servers
• Synapse error logs showing canonical JSON encoding failures

Detection Strategies

• Monitor Synapse federation logs for repeated event processing failures from specific origins
• Implement alerting on sudden drops in successful federation traffic
• Review logs for error messages mentioning integer overflow, depth validation, or canonical JSON encoding issues
• Track federation health metrics and alert on anomalous patterns

Monitoring Recommendations

• Enable verbose logging for federation-related components during incident investigation
• Implement network monitoring for unusual federation traffic patterns from unknown or suspicious homeservers
• Configure alerts for Synapse service restarts or crashes that may indicate exploitation attempts
• Monitor system resource usage as federation failures may cause cascading effects

How to Mitigate CVE-2025-30355

Immediate Actions Required

• Upgrade all Matrix Synapse installations to version 1.127.1 or later immediately
• Review federation logs for signs of exploitation prior to patching
• Monitor federation health closely after applying the update
• Consider temporarily restricting federation to trusted servers if immediate patching is not possible

Patch Information

The vulnerability has been fixed in Synapse v1.127.1. The security patch is available through the GitHub Security Advisory and detailed in the release notes. The fix properly constrains event depth values to the canonical JSON integer range (2**53 - 1) to ensure consistent processing across federation.

The specific commit implementing the fix can be reviewed at the GitHub commit.

Workarounds

• No known workarounds are available for this vulnerability
• Upgrading to Synapse v1.127.1 or later is the only effective mitigation
• Organizations unable to patch immediately should implement enhanced monitoring for federation anomalies
• Consider network-level restrictions on federation traffic as a temporary measure while planning the upgrade

# Upgrade Synapse to the patched version
pip install matrix-synapse==1.127.1

# Verify the installed version
python -m synapse.app.homeserver --version

# Restart Synapse service after upgrade
systemctl restart matrix-synapse