PyPI/matrix-synapse CVE-2025-61672: medium, EPSS 0.47%
Synapse's invalid device keys degrade federation functionality
Action: Upgrade matrix-synapse to 1.138.3 or later.
pip install matrix-synapse==1.138.3pip install matrix-synapse==1.139.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.138.3 | - |
| 1.139.0rc2 | 1.139.1 | - |
Fixed versions
| 1.138.3 | 1.139.1 |
Sources
- osv: GHSA-fh66-fcv5-jjfr
- https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr
- https://nvd.nist.gov/vuln/detail/CVE-2025-61672
- https://github.com/element-hq/synapse/pull/17097
- https://github.com/element-hq/synapse/commit/26aaaf9e48fff80cf67a20c691c75d670034b3c1
- https://github.com/element-hq/synapse/commit/7069636c2d6d1ef2022287addf3ed8b919ef2740
- https://github.com/element-hq/synapse
- https://github.com/element-hq/synapse/releases/tag/v1.138.3
- https://github.com/element-hq/synapse/releases/tag/v1.138.4
- https://github.com/element-hq/synapse/releases/tag/v1.139.1
- https://github.com/element-hq/synapse/releases/tag/v1.139.2
CVE-2025-61672 · published · modified · JSON