CVE-2024-52805

What it actually does

The vulnerability allows certain multipart/form-data requests to cause transient memory consumption spikes beyond normal levels during request processing in Synapse, enabling resource exhaustion.

Why it matters to the business

Attackers can disrupt availability of the Matrix homeserver, leading to degraded chat and collaboration services until the server is restarted or resources are freed.

How an attack unfolds

An attacker identifies a Synapse instance accepting multipart/form-data requests and sends crafted requests that trigger excessive memory allocation during parsing, repeatedly amplifying usage to induce denial of service without authentication in affected configurations.

How to fix it

Upgrade element-hq/synapse to version 1.120.1 or later, which includes the fix from commit fe3d88b833f76742874642c119b14b788341c905. Review server configuration to limit multipart request sizes where possible until patched.

How to confirm the fix worked

Verify the deployed Synapse version is 1.120.1 or newer via the /_matrix/federation/v1/version endpoint or package metadata; test with controlled multipart requests while monitoring memory usage to confirm no abnormal spikes occur.

Typical attack path

1. Scan for publicly reachable Synapse instances running versions prior to 1.120.1
2. Craft multipart/form-data payloads designed to maximize memory retention during processing
3. Transmit multiple concurrent or sequential requests to the vulnerable endpoint
4. Monitor for memory exhaustion leading to service slowdown or crash

How to detect it

Review Synapse request logs and system memory metrics for spikes correlated with multipart/form-data POSTs; look for patterns of high concurrent request volume from single sources or unusual content lengths in access logs.

What your security team should do

• Immediately schedule upgrade to the fixed version given the public disclosure and potential for amplification attacks
• Implement rate limiting and request size caps on multipart endpoints as a temporary control
• Monitor memory and request logs for anomalous patterns until patching is complete