matrix-org matrix-rust-sdk vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20241
3. 20255
4. 20261

Newest CVEs

• CVE-2026-45056

  Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

  matrix-org · matrix-rust-sdk

  Medium6.9
• CVE-2025-66622

  matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values

  matrix-org · matrix-rust-sdk

  Low1.3
• CVE-2025-59047

  matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method

  matrix-org · matrix-rust-sdk

  Low2.7
• CVE-2025-53549

  Matrix Rust SDK allows SQL injection in the EventCache implementation

  matrix-org · matrix-rust-sdk

  Medium5.2
• CVE-2025-48937

  matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

  matrix-org · matrix-rust-sdk

  Medium4.9
• CVE-2024-52813

  matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

  matrix-org · matrix-rust-sdk

  Medium4.3
• CVE-2024-40648

  `UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk

  matrix-org · matrix-rust-sdk

  Medium5.4
• CVE-2022-39252

  When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder

  matrix-org · matrix-rust-sdk

  High8.6