{"cve":"CVE-2025-61672","nvd":{"published":"2025-10-08T15:16:25.110","modified":"2026-10-08T13:10:00.200","status":"Deferred","description":"Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":5.3},"cvss_v3":null,"cwes":["CWE-1287"],"references":["https://github.com/element-hq/synapse/commit/26aaaf9e48fff80cf67a20c691c75d670034b3c1","https://github.com/element-hq/synapse/commit/7069636c2d6d1ef2022287addf3ed8b919ef2740","https://github.com/element-hq/synapse/pull/17097","https://github.com/element-hq/synapse/releases/tag/v1.138.3","https://github.com/element-hq/synapse/releases/tag/v1.139.1"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:11:26.888974865+00:00"},"epss":{"cve":"CVE-2025-61672","score":0.00466,"percentile":0.40035,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-fh66-fcv5-jjfr","url":"https://osv.dev/vulnerability/GHSA-fh66-fcv5-jjfr","summary":"Synapse's invalid device keys degrade federation functionality","modified":"2026-07-07T17:56:22.342793625Z","packages":[{"ecosystem":"PyPI","name":"matrix-synapse","purl":"pkg:pypi/matrix-synapse","ranges":["<1.138.3"],"fixed":["1.138.3"]},{"ecosystem":"PyPI","name":"matrix-synapse","purl":"pkg:pypi/matrix-synapse","ranges":[">=1.139.0rc2 <1.139.1"],"fixed":["1.139.1"]}]},{"id":"PYSEC-2026-1612","url":"https://osv.dev/vulnerability/PYSEC-2026-1612","summary":"Synapse's invalid device keys degrade federation functionality","modified":"2026-07-07T17:46:57.337789820Z","packages":[{"ecosystem":"PyPI","name":"matrix-synapse","purl":"pkg:pypi/matrix-synapse","ranges":["<1.138.3",">=1.139.0rc2 <1.139.1"],"fixed":["1.138.3","1.139.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}