Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: synapse fixed in 1.139.2-r0
AnalysisAI
Synapse (Matrix homeserver) on Alpine Linux contains an uncharacterized vulnerability addressed in package version 1.139.2-r0. The upstream nature, attack vector, and exploitability class are not disclosed in available intelligence. With an EPSS score of 0.05% (14th percentile), exploitation probability is currently low, and no active exploitation or public exploit code has been identified at time of analysis.
Technical ContextAI
Synapse is the reference Matrix homeserver implementation written in Python, maintained by Element (formerly New Vector). It implements the Matrix open standard for decentralized, real-time communication. The affected package is distributed via Alpine Linux's apk package manager as 'synapse'. The fix is contained in Alpine package version 1.139.2-r0, which corresponds to Synapse upstream version 1.139.2. No CWE classification is available, meaning the root cause class (e.g., injection, authentication bypass, memory corruption, logic flaw) cannot be determined from current data. No CPE strings were provided to further scope affected configurations.
Affected ProductsAI
Alpine Linux distributions running the synapse Matrix homeserver package prior to version 1.139.2-r0 are confirmed affected per the Alpine Linux vendor advisory. This corresponds to Synapse upstream version 1.139.2. Specific Alpine Linux release branches (e.g., edge, v3.x) affected are not detailed in available data. No CPE strings were provided to further narrow scope. Users running Synapse via other distributions or via the upstream Python package (PyPI) should consult the upstream Element/matrix.org changelog and security advisories for applicability.
RemediationAI
Upgrade the Alpine Linux synapse package to version 1.139.2-r0 or later using 'apk upgrade synapse'. This is the vendor-confirmed fix per the Alpine Linux security advisory. For users running Synapse on other platforms, consult the upstream Synapse changelog at github.com/element-hq/synapse for release notes corresponding to version 1.139.2. Because the vulnerability class is unknown, no targeted workarounds can be recommended with confidence. As a general compensating control pending patching, restrict network access to the Synapse federation and client-server API endpoints to trusted networks, and ensure Synapse is not exposed unnecessarily to untrusted users or external federation partners - noting these controls may impact Matrix federation functionality.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today