CVE-2020-26890
Denial of service attack due to invalid JSON
Reported by mitre · Published November 24, 2020
matrix-synapse is fixed in 1.20.0 (PyPI)
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be manually redacted instead. Since events are replicated to servers of other room members, the impact is not constrained to the server of the event sender.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| matrix-synapse | PyPI | 1.20.0 |
| matrix-synapse | Arch Linux | 1.20.1-1 |
| synapse | matrix | 1.20.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| PyPI | matrix-synapse | 0 |
| arch | matrix-synapse | 0 |
| n/a | n/a | * |
| alpine | synapse | 0 |
Timeline
- Nov 24, 2020 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Aug 4, 2024 CVE Updated
- Mar 9, 2026 Security Advisory
- Sep 1, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2020-26890
vulnetix vdb fixes CVE-2020-26890Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2020-26890/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_MISC
- FEDORA-2020-b90dac7fc4 vendor-advisoryx_refsource_FEDORA
- FEDORA-2020-2578d943d2 vendor-advisoryx_refsource_FEDORA
- https://nvd.nist.gov/vuln/detail/CVE-2020-26890 advisory
- https://github.com/advisories/GHSA-4mp3-385r-v63f advisory
- https://github.com/matrix-org/synapse url
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2020-237.yaml advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G7YXMMYQP46PYL664JQUXCA3LPBJU7DQ url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U34DPP4ZLOEDUY2ZCWOHQPU5GA5LYNUQ url
- https://pypi.org/project/matrix-synapse url