CVE-2025-66622

matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.

• CWE-755

• https://github.com/matrix-org/matrix-rust-sdk/commit/4ea0418abefab2aa93f8851a4d39c723e703e6b0Patch
• https://github.com/matrix-org/matrix-rust-sdk/pull/5924Issue Tracking, Patch
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3Patch, Vendor Advisory
• https://rustsec.org/advisories/RUSTSEC-2025-0135.htmlThird Party Advisory

Published

Dec 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66608A vulnerability has been found in FAST/TOOLS provided by Yok…7.5
• CVE-2025-6661PDF-XChange Editor App Object Use-After-Free Remote Code Exe…7.8
• CVE-2025-66614Improper Input Validation vulnerability. This issue affects…9.1
• CVE-2025-66617An out-of-bounds read vulnerability exists in the EMF functi…7.1
• CVE-2025-6662PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Infor…3.3
• CVE-2025-66620An unused webshell in MicroServer allows unlimited login att…7.2
• CVE-2025-66623Strimzi provides a way to run an Apache Kafka cluster on Kub…7.4
• CVE-2025-66624BACnet Protocol Stack library provides a BACnet application …7.5
• CVE-2025-66625Umbraco is an ASP.NET CMS. Due to unsafe handling and deleti…4.9
• CVE-2025-66626Argo Workflows is an open source container-native workflow e…7.5
• CVE-2025-66627Wasmi is a WebAssembly interpreter focused on constrained an…7.8
• CVE-2025-66628ImageMagick is a software suite to create, edit, compose, or…7.5