CVE-2024-37302

Advisory

Affected versions of Synapse are vulnerable to Allocation of Resources Without Limits or Throttling (CWE-770). This vulnerability allows unauthenticated attackers to induce excessive remote media downloads, potentially exhausting disk space and causing denial of service, ranging from failed media operations to complete Synapse unavailability. The attack vector exploits unauthenticated media download endpoints with inadequate rate limiting. To mitigate this issue, upgrade to Synapse version 1.106 or later, which introduces a "leaky bucket" rate limit on media downloads. Additionally, server operators can limit maximum file sizes or allocate media storage to dedicated disks to reduce impact.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-4mhg-xv73-xq2x
• https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37302