Matrix Rust Sdk
Approved changes feed: RSS · Atom
cpe:2.3:a:matrix:matrix-rust-sdk:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Matrix (eeffbdfc-c7a5-5b43-a123-a772af0b6d34) |
|---|---|
| Product | Matrix Rust Sdk (5958c4e0-4399-5d97-aaff-2c3ad36a9c95) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/matrix-org/matrix-rust-sdk |
purl2cpe | 2026-06-01 10:13:24.252522 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-66622 |
vulnerable | 2026-06-03 15:11:01.001441 |
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.
Published: 2025-12-09T02:07:18.831Z
Updated: 2025-12-09T16:02:47.455Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39252 |
vulnerable | 2026-06-03 14:47:51.320969 |
When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder
HIGH (8.6)
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.
Published: 2022-09-29T14:15:14.000Z
Updated: 2025-04-23T16:54:05.100Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.