CVE-2024-52805
Synapse allows unsupported content types to lead to memory exhaustion
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Synapse allows unsupported content types to lead to memory exhaustion
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
Reserved 2024-11-15 | Published 2024-12-03 | Updated 2024-12-03 | Assigner GitHub_MCWE-770: Allocation of Resources Without Limits or Throttling
github.com/...ynapse/security/advisories/GHSA-rfq8-j7rh-8hf2
github.com/twisted/twisted/issues/4688
github.com/twisted/twisted/issues/4688
Support options
