CVE-2024-37302

Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.

• CWE-770

• https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2xVendor Advisory

Published

Dec 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37297WooCommerce is an open-source e-commerce platform built on W…5.4
• CVE-2024-37298gorilla/schema converts structs to and from form values. Pri…7.5
• CVE-2024-37299Discourse is an open source discussion platform. Prior to 3.…7.5
• CVE-2024-3730The Simple Membership plugin for WordPress is vulnerable to …5.4
• CVE-2024-37300OAuthenticator is software that allows OAuth2 identity provi…8.1
• CVE-2024-37301Document Merge Service is a document template merge service …7.2
• CVE-2024-37303Synapse is an open-source Matrix homeserver. Synapse before …5.3
• CVE-2024-37304NuGet Gallery is a package repository that powers nuget.org.…6.1
• CVE-2024-37305oqs-provider is a provider for the OpenSSL 3 cryptography li…8.2
• CVE-2024-37306Computer Vision Annotation Tool (CVAT) is an interactive vid…7.1
• CVE-2024-37307Cilium is a networking, observability, and security solution…6.5
• CVE-2024-37308The Cooked Pro recipe plugin for WordPress is vulnerable to …5.4