{"action":"Upgrade matrix-sdk-crypto to 0.11.1 or later.","affected":[{"fixed":"0.11.1","introduced":"0.8.0"}],"component":"matrix-sdk-crypto","cve_ids":["CVE-2025-48937"],"ecosystem":"crates.io","epss":0.00385,"exploited":false,"fixed_versions":["0.11.1"],"ghsa_id":"GHSA-x958-rvg6-956w","id":"tcs_01M5KF4NEHP9WZ7NK77Q7GQ3E6","modified_at":"2025-06-12T21:23:37Z","published_at":"2025-06-10T20:15:37Z","references":["https://osv.dev/vulnerability/GHSA-x958-rvg6-956w","https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w","https://nvd.nist.gov/vuln/detail/CVE-2025-48937","https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55","https://github.com/matrix-org/matrix-rust-sdk/commit/56980745b4f27f7dc72ac296e6aa003e5d92a75b","https://github.com/matrix-org/matrix-rust-sdk","https://rustsec.org/advisories/RUSTSEC-2025-0041.html","https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-x958-rvg6-956w","url":"https://osv.dev/vulnerability/GHSA-x958-rvg6-956w"}],"summary":"matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator"}