CVE-2025-66622 - CVE House
Back to Database
Status published Low CVE-2025-66622

matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values

Vulnerability Description

matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66622

Credits & Attribution

No credits recorded in the NVD database.

References

More from matrix-org

View All →
CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Low 2.7
CVE-2025-59047
matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
Low 2.7
CVE-2025-53549
Matrix Rust SDK allows SQL injection in the EventCache implementation
Medium 5.2
CVE-2025-48937
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
Medium 4.9
CVE-2025-27155
In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim
Medium 6.1

Affected Vendor

Affected Software

matrix-rust-sdk
Vulnerable Versions:
< 0.16.0

Timeline

Official Publish: December 9th, 2025
Last Modified: December 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-755

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection
T1499 Endpoint Denial of Service
Impact