CVE catalog

CVE-2024-42369

UBUNTU-CVE-2024-42369

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.48% · Oct 25, 2026

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-matrix-js-sdk119.11.0+~cs9.9.16-1vulnerable
Debiannode-matrix-js-sdk119.11.0+~cs9.9.16-2vulnerable
Debiannode-matrix-js-sdk119.3.0+~cs9.9.16-2vulnerable
Debiannode-matrix-js-sdk119.7.0~~rc1+~cs9.9.16-1vulnerable
Debiannode-matrix-js-sdk119.7.0~~rc1+~cs9.9.16-2vulnerable
Opensuseelement-webtumbleweed1.11.75-1.1fixed
Opensuseelement-desktoptumbleweed1.11.75-1.1fixed
Ubuntunode-matrix-js-sdk20.040.9.2-1vulnerable
Ubuntunode-matrix-js-sdk22.049.3.0+~cs9.9.16-2vulnerable
Ubuntunode-matrix-js-sdk22.049.11.0+~cs9.9.16-1vulnerable
Ubuntunode-matrix-js-sdk24.049.11.0+~cs9.9.16-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Opensuseelement-webrpmtumbleweed1.11.75-1.1Not reportedOPENSUSE-SU-2024:14289-1Not reported
Opensuseelement-desktoprpmtumbleweed1.11.75-1.1Not reportedOPENSUSE-SU-2024:14288-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]