CVE-2022-41952

Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. Upgrade to 1.53.0 to fully resolve the issue. As a workaround, turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file.

• CWE-400
• CWE-772

• https://github.com/matrix-org/synapse/pull/11784Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/pull/11936Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.52.0Release Notes, Third Party Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.53.0Release Notes, Third Party Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47hMitigation, Third Party Advisory
• https://github.com/matrix-org/synapse/pull/11784Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/pull/11936Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.52.0Release Notes, Third Party Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.53.0Release Notes, Third Party Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47hMitigation, Third Party Advisory

Published

Nov 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41947DHIS 2 is an open source information system for data capture…5.4
• CVE-2022-41948DHIS 2 is an open source information system for data capture…7.2
• CVE-2022-41949DHIS 2 is an open source information system for data capture…4.3
• CVE-2022-4195Insufficient policy enforcement in Safe Browsing in Google C…4.3
• CVE-2022-41950super-xray is the GUI alternative for vulnerability scanning…7.8
• CVE-2022-41951OroPlatform is a PHP Business Application Platform (BAP) des…9.8
• CVE-2022-41953Git GUI is a convenient graphical tool that comes with Git f…7.8
• CVE-2022-41954MPXJ is an open source library to read and write project pla…3.3
• CVE-2022-41955Autolab is a course management service, initially developed …8.8
• CVE-2022-41956Autolab is a course management service, initially developed …6.5
• CVE-2022-41957Muhammara is a node module with c/cpp bindings to modify PDF…7.5
• CVE-2022-41958super-xray is a web vulnerability scanning tool. Versions pr…7.8