CVE catalog

CVE-2022-41952

UBUNTU-

[CVE catalog]

Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. Upgrade to 1.53.0 to fully resolve the issue. As a workaround, turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file.

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.91% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Ubuntupromatrix-synapse0.19.2+dfsg-6Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse0.24.0+dfsg-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse0.24.0+dfsg-1ubuntu0.1~esm1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse0.24.0+dfsg-1ubuntu0.1~esm4Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.10.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.10.0-2Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.11.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.11.0-1ubuntu0.1~esm2Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.3.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.4.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.5.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.5.1-1Affected[UBUNTU-CVE-2022-41952]

Showing 12 observations. All 21 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Ubuntupromatrix-synapse0.19.2+dfsg-6Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse0.24.0+dfsg-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse0.24.0+dfsg-1ubuntu0.1~esm1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse0.24.0+dfsg-1ubuntu0.1~esm4Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.10.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.10.0-2Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.11.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.11.0-1ubuntu0.1~esm2Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.3.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.4.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.5.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.5.1-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.6.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.6.1-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.7.0-2Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.7.1-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.7.2-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.7.3-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.8.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.9.0-1Affected[UBUNTU-CVE-2022-41952]
Ubuntupromatrix-synapse1.9.1-1Affected[UBUNTU-CVE-2022-41952]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "matrix-synapse",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0.19.2+dfsg-6",
        "0.24.0+dfsg-1",
        "0.24.0+dfsg-1ubuntu0.1~esm1",
        "0.24.0+dfsg-1ubuntu0.1~esm4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-41952",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-41952",
      "provider_updated_at": "2025-09-08T16:50:26Z"
    },
    {
      "name": "matrix-synapse",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.3.0-1",
        "1.4.0-1",
        "1.5.0-1",
        "1.5.1-1",
        "1.6.0-1",
        "1.6.1-1",
        "1.7.0-2",
        "1.7.1-1",
        "1.7.2-1",
        "1.7.3-1",
        "1.8.0-1",
        "1.9.0-1",
        "1.9.1-1",
        "1.10.0-1",
        "1.10.0-2",
        "1.11.0-1",
        "1.11.0-1ubuntu0.1~esm2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-41952",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-41952",
      "provider_updated_at": "2025-09-08T16:50:26Z"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]