{"action":"Upgrade matrix-synapse to 1.106.0 or later.","affected":[{"fixed":"1.106.0","introduced":"0"}],"component":"matrix-synapse","cve_ids":["CVE-2024-37303"],"ecosystem":"PyPI","epss":0.0043,"exploited":false,"fixed_versions":["1.106.0"],"ghsa_id":"GHSA-gjgr-7834-rhxr","id":"tcs_01M5KGMYAG4F7Z9DKDGWHNP9EF","modified_at":"2026-05-20T09:19:06.870905Z","published_at":"2024-12-03T17:15:10.890Z","references":["https://osv.dev/vulnerability/PYSEC-2024-287","https://github.com/element-hq/synapse/security/advisories/GHSA-gjgr-7834-rhxr","https://github.com/matrix-org/matrix-spec-proposals/pull/3916"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2024-287","url":"https://osv.dev/vulnerability/PYSEC-2024-287"}],"summary":"Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeser"}