CVE-2025-66622

matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/matrix-org/matrix-rust-sdk/commit/4ea0418abefab2aa93f8851a4d39c723e703e6b0	Patch
https://github.com/matrix-org/matrix-rust-sdk/pull/5924	Issue Tracking Patch
https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3	Patch Vendor Advisory
https://rustsec.org/advisories/RUSTSEC-2025-0135.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:matrix:matrix-rust-sdk:*:*:*:*:*:*:*:*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) matrix-sdk-base es el componente base para construir una biblioteca cliente de Matrix. Las versiones 0.14.1 y anteriores no pueden manejar respuestas que incluyen valores personalizados de m.room.join_rules debido a un error de serialización. Esto puede ser explotado para causar una condición de denegación de servicio: si un usuario es invitado a una sala con reglas de unión no estándar, el proceso de sincronización del crate se detendrá, impidiendo el procesamiento posterior para todas las salas. Esto está corregido en la versión 0.16.0.

Information

Published : 2025-12-09 16:18

Updated : 2026-10-07 20:10

NVD link : CVE-2025-66622

Mitre link : CVE-2025-66622

CVE.ORG link : CVE-2025-66622

JSON object : View

Products Affected

matrix

matrix-rust-sdk

CWE

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2025-66622", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66622", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T14:16:11.253556Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "matrix-org", "product": "matrix-rust-sdk", "versions": [{"status": "affected", "version": "< 0.16.0"}]}]}], "published": "2025-12-09T16:18:21.747", "references": [{"url": "https://github.com/matrix-org/matrix-rust-sdk/commit/4ea0418abefab2aa93f8851a4d39c723e703e6b0", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/matrix-rust-sdk/pull/5924", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://rustsec.org/advisories/RUSTSEC-2025-0135.html", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0."}, {"lang": "es", "value": "matrix-sdk-base es el componente base para construir una biblioteca cliente de Matrix. Las versiones 0.14.1 y anteriores no pueden manejar respuestas que incluyen valores personalizados de m.room.join_rules debido a un error de serializaci\u00f3n. Esto puede ser explotado para causar una condici\u00f3n de denegaci\u00f3n de servicio: si un usuario es invitado a una sala con reglas de uni\u00f3n no est\u00e1ndar, el proceso de sincronizaci\u00f3n del crate se detendr\u00e1, impidiendo el procesamiento posterior para todas las salas. Esto est\u00e1 corregido en la versi\u00f3n 0.16.0."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:matrix:matrix-rust-sdk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "266C20E9-3581-4C38-B367-6DFAA2CF6A0B", "versionEndExcluding": "0.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}