Matrix Synapse CPU Starvation Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Matrix Synapse versions prior to 1.152.1. This issue allows local authenticated users to consume excessive CPU resources, causing other requests to fail and denying service to other users. Homeservers that trust all local users are not vulnerable.

Impact

Exploitation of this vulnerability leads to CPU starvation, causing requests to fail and denying service to other users.

Remediation

Users can update to Synapse version 1.152.1 or later to address this vulnerability. If Synapse is behind a reverse proxy, the proxy can be configured to limit user request rates, mitigating the attack.