CVE-2019-11340: Matrix Sydent

Medium severity, CVSS 5.9. EPSS: 1.9% chance of exploitation in the next 30 days.

util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.

Affected products

• Matrix Sydent: before 1.0.2 (fixed in 1.0.2)

Published 2019-04-19. Last modified 2026-06-17.