Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse     before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade     federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is     patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix     the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers     of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.
    (CVE-2025-61672)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse
    before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade
    federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is
    patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix
    the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers
    of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.
    (CVE-2025-61672)

ID	Name	Product	Family	Type	Severity
270259	Linux Distros Unpatched Vulnerability : CVE-2025-61672	Nessus	Misc.	Local	medium
435539	SCA: security update for matrix-synapse (GHSA-fh66-fcv5-jjfr)	Tenable Cloud Security	SCA Checks	Local	medium
435539	SCA: security update for matrix-synapse (GHSA-fh66-fcv5-jjfr)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
435536	Alpine: multiple synapse packages: security update to 1.139.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
435536	Alpine: multiple synapse packages: security update to 1.139.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2025-61672

medium

Tenable Plugins

medium

medium

medium

medium

medium