{"id":"CVE-2025-66622","sourceIdentifier":"security-advisories@github.com","published":"2025-12-09T16:18:21.747","lastModified":"2026-10-07T20:10:01.970","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0."},{"lang":"es","value":"matrix-sdk-base es el componente base para construir una biblioteca cliente de Matrix. Las versiones 0.14.1 y anteriores no pueden manejar respuestas que incluyen valores personalizados de m.room.join_rules debido a un error de serialización. Esto puede ser explotado para causar una condición de denegación de servicio: si un usuario es invitado a una sala con reglas de unión no estándar, el proceso de sincronización del crate se detendrá, impidiendo el procesamiento posterior para todas las salas. Esto está corregido en la versión 0.16.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"matrix-org","product":"matrix-rust-sdk","versions":[{"version":"< 0.16.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-09T14:16:11.253556Z","id":"CVE-2025-66622","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-755"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:matrix:matrix-rust-sdk:*:*:*:*:*:*:*:*","versionEndExcluding":"0.16.0","matchCriteriaId":"266C20E9-3581-4C38-B367-6DFAA2CF6A0B"}]}]}],"references":[{"url":"https://github.com/matrix-org/matrix-rust-sdk/commit/4ea0418abefab2aa93f8851a4d39c723e703e6b0","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/matrix-org/matrix-rust-sdk/pull/5924","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0135.html","source":"security-advisories@github.com","tags":["Third Party Advisory"]}]}