CVE-2019-18835: Matrix Synapse

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.

Affected products

• Matrix Synapse: before 1.5.0 (fixed in 1.5.0)

Published 2019-11-08. Last modified 2026-06-17.