CVE-2022-39252

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.

• CWE-287
• CWE-322

• https://github.com/matrix-org/matrix-rust-sdk/commit/093fb5d0aa21c0b5eaea6ec96b477f1075271cbbPatch, Third Party Advisory
• https://github.com/matrix-org/matrix-rust-sdk/commit/41449d2cc360e347f5d4e1c154ec1e3185f11acdPatch, Third Party Advisory
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.6.0Release Notes, Third Party Advisory
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-vp68-2wrm-69qmThird Party Advisory
• https://github.com/matrix-org/matrix-rust-sdk/commit/093fb5d0aa21c0b5eaea6ec96b477f1075271cbbPatch, Third Party Advisory
• https://github.com/matrix-org/matrix-rust-sdk/commit/41449d2cc360e347f5d4e1c154ec1e3185f11acdPatch, Third Party Advisory
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.6.0Release Notes, Third Party Advisory
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-vp68-2wrm-69qmThird Party Advisory

Published

Sep 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39246matrix-android-sdk2 is the Matrix SDK for Android. Prior to …5.3
• CVE-2022-39248matrix-android-sdk2 is the Matrix SDK for Android. Prior to …7.5
• CVE-2022-39249Matrix Javascript SDK is the Matrix Client-Server SDK for Ja…7.5
• CVE-2022-3925The buddybadges WordPress plugin through 1.0.0 does not sani…7.2
• CVE-2022-39250Matrix JavaScript SDK is the Matrix Client-Server software d…7.5
• CVE-2022-39251Matrix Javascript SDK is the Matrix Client-Server SDK for Ja…7.5
• CVE-2022-39253Git is an open source, scalable, distributed revision contro…5.5
• CVE-2022-39254matrix-nio is a Python Matrix client library, designed accor…6.5
• CVE-2022-39255Matrix iOS SDK allows developers to build iOS apps compatibl…7.5
• CVE-2022-39256Orckestra C1 CMS is a .NET based Web Content Management Syst…8
• CVE-2022-39257Matrix iOS SDK allows developers to build iOS apps compatibl…7.5
• CVE-2022-39258mailcow is a mailserver suite. A vulnerability innversions p…8.2