CVE-2024-31208

Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate excessive data in the database of such instances, resulting in a denial of service. Servers in private federations, or those that do not federate, are not affected. Server administrators should upgrade to 1.105.1 or later. Some workarounds are available. One can ban the malicious users or ACL block servers from the rooms and/or leave the room and purge the room using the admin API.

• CWE-770

• https://github.com/element-hq/synapse/commit/55b0aa847a61774b6a3acdc4b177a20dc019f01aPatch
• https://github.com/element-hq/synapse/releases/tag/v1.105.1Release Notes
• https://github.com/element-hq/synapse/security/advisories/GHSA-3h7q-rfh9-xm4vVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R6FCCO4ODTZ3FDS7TMW76PKOSEL2TQVB/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RR53FNHV446CB37TP45GZ6F6HZLZCK3K/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSF4NJJSTSQRJQ47PLYYSCFYKJBP7DET/Mailing List, Third Party Advisory
• https://github.com/element-hq/synapse/commit/55b0aa847a61774b6a3acdc4b177a20dc019f01aPatch
• https://github.com/element-hq/synapse/releases/tag/v1.105.1Release Notes
• https://github.com/element-hq/synapse/security/advisories/GHSA-3h7q-rfh9-xm4vVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R6FCCO4ODTZ3FDS7TMW76PKOSEL2TQVB/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RR53FNHV446CB37TP45GZ6F6HZLZCK3K/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSF4NJJSTSQRJQ47PLYYSCFYKJBP7DET/Mailing List, Third Party Advisory

Published

Apr 23, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31202A “CWE-732: Incorrect Permission Assignment for Critical Res…7.8
• CVE-2024-31203A “CWE-121: Stack-based Buffer Overflow” in the wd210std.dll…5.5
• CVE-2024-31204mailcow: dockerized is an open source groupware/email suite …6.1
• CVE-2024-31205Saleor is an e-commerce platform. Starting in version 3.10.0…5.4
• CVE-2024-31206dectalk-tts is a Node package to interact with the aeiou Dec…8.2
• CVE-2024-31207Vite (French word for "quick", pronounced /vit/, like "veet"…5.9
• CVE-2024-31209oidcc is the OpenID Connect client library for Erlang. Denia…5.3
• CVE-2024-3121A remote code execution vulnerability exists in the create_c…3.3
• CVE-2024-31210WordPress is an open publishing platform for the Web. It's p…8.8
• CVE-2024-31211WordPress is an open publishing platform for the Web. Unseri…9.8
• CVE-2024-31212InstantCMS is a free and open source content management syst…7.2
• CVE-2024-31213InstantCMS is a free and open source content management syst…5.4