{"action":"Upgrade matrix-sdk-crypto to 0.11.1 or later.","affected":[{"fixed":"0.11.1","introduced":"0.8.0"}],"component":"matrix-sdk-crypto","cve_ids":["CVE-2025-48937"],"ecosystem":"crates.io","epss":0.00369,"exploited":false,"fixed_versions":["0.11.1"],"ghsa_id":"GHSA-x958-rvg6-956w","id":"tcs_01M5KF9ZD00ZWYDR7B1EJQ85CZ","modified_at":"2026-10-12T18:00:10.940253855Z","published_at":"2025-06-11T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2025-0041","https://crates.io/crates/matrix-sdk-crypto","https://rustsec.org/advisories/RUSTSEC-2025-0041.html","https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"RUSTSEC-2025-0041","url":"https://osv.dev/vulnerability/RUSTSEC-2025-0041"}],"summary":"matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator"}