Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
element-hq/synapse
develop @ ab277b3
379
Fixes
42
CVEs
CRITICAL
Peak severity
35.7%
Coverage
Highlights
Denial of Service: 150 prior fixes. Scrutinize any change in this area.
synapse/api/auth.py: most-fixed (26 issues). Treat as high-risk during review.
128 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Type confusion and boolean power level checks in room state authorization let attackers bypass standard permissions or escalate rank. Developers should enforce strict type validation instead of relying on loose type checking.
Denial of Service: Oversized to-device EDUs and unbounded looping calls during event purging can block outbound queues, leading to federation starvation. Implementing strict length limits and splitting mechanisms prevents queue bloat.
Auth Bypass: A lack of cross-room verification during federated state resolution (e.g. resolve_events_with_store) lets malicious homeservers inject state and auth events from unrelated rooms into local state.