CVE-2025-66622

The record

matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.

Affected packages

Related vulnerabilities

• RUSTSEC-2025-0135 matrix-sdk-base: Denial of service due to custom `m.room.join_rules` events Same vulnerability
• CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
• CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
• CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755
• CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. CWE-755
• CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful… CWE-755
• CVE-2026-45819 baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on… CWE-755
• CVE-2026-52856 Wings is the server control plane for Pterodactyl, a free, open-source game server… CWE-755