CVE-2024-52805 - CVE House

Back to Database

Status published High CVE-2024-52805

Synapse allows unsupported content types to lead to memory exhaustion

8.2 CVSS

Vulnerability Description

Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-52805

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from element-hq

View All →

Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password

Synapse: Invalid device keys degrade federation functionality

In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left

Element Web could load a malicious instance of Element Call leaking media encryption keys

Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

Affected Vendor

element-hq

View all reports →

Affected Software

synapse

Vulnerable Versions:

< 1.120.1

Timeline

Official Publish: December 3rd, 2024

Last Modified: December 3rd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1190 Exploit Public-Facing Application

T1562 Impair Defenses

Defense Evasion

T1046 Network Service Discovery