What is the CVSS score of CVE-2025-66622?

CVE-2025-66622 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2025-66622?

Organizations using matrix-sdk-base face notable risk from CVE-2025-66622 rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-66622?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Python CVE-2025-66622

HIGH

Improper Handling of Exceptional Conditions (CWE-755)

2025-12-09 security-advisories@github.com

GHSA-jj6p-3m75-g2p3

Denial Of Service Deserialization Python Matrix Rust Sdk

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

CVE Published

Dec 09, 2025 - 16:18 nvd

HIGH 7.5

DescriptionGitHub Advisory

matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.

AnalysisAI

A serialization bug in matrix-sdk-base allows remote attackers to cause denial-of-service by sending rooms with custom m.room.join_rules values, which stalls the sync process and prevents all room processing. The vulnerability affects matrix-sdk-base versions 0.14.1 and prior and has a high availability impact (CVSS 7.5) with a patch available in version 0.16.0. With a low EPSS score of 0.06% and no KEV listing, this represents a moderate real-world risk primarily concerning service availability rather than active exploitation.

Technical ContextAI

The matrix-sdk-base is a Rust library component used to build Matrix protocol clients, identified by CPE cpe:2.3:a:matrix:matrix-rust-sdk:*:*:*:*:*:*:*:*. The vulnerability stems from CWE-755 (Improper Handling of Exceptional Conditions), where the deserialization logic cannot properly handle non-standard or custom m.room.join_rules values in Matrix room state events. When the sync process encounters these malformed join rules during room invitation processing, it fails to deserialize the response correctly, causing the entire synchronization mechanism to halt and preventing the client from processing any further room updates across all rooms.

RemediationAI

Upgrade matrix-sdk-base to version 0.16.0 or later, which includes the fix implemented in commit 4ea0418abefab2aa93f8851a4d39c723e703e6b0 and pull request #5924. The patch is available from the vendor at https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3. As a temporary workaround until patching is possible, consider implementing application-level filtering to reject or quarantine room invitations containing non-standard join rules before they reach the SDK's sync process, though upgrading remains the recommended solution.