{"id":"EUVD-2025-201827","enisaUuid":"9863f5b6-0126-30a0-8afb-cce422e5e94e","description":"matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate\u0027s sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.","datePublished":"Dec 9, 2025, 2:07:18 AM","dateUpdated":"Dec 9, 2025, 4:02:47 PM","baseScore":1.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","references":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3\nhttps://github.com/matrix-org/matrix-rust-sdk/pull/5924\nhttps://github.com/matrix-org/matrix-rust-sdk/commit/4ea0418abefab2aa93f8851a4d39c723e703e6b0\nhttps://rustsec.org/advisories/RUSTSEC-2025-0135.html\n","aliases":"CVE-2025-66622\nGHSA-jj6p-3m75-g2p3\n","assigner":"GitHub_M","epss":0.41,"enisaIdProduct":[{"id":"d49699e2-ccdb-3761-830c-6a426bbd55cc","product":{"name":"matrix-rust-sdk","vendor":{"name":"matrix-org"}},"product_version":"\u003c 0.16.0"}],"enisaIdVendor":[{"id":"d81e2d80-519f-36ce-8ca0-c30390080aa5","vendor":{"name":"matrix-org"}}],"enisaIdVulnerability":[{"id":"985df91e-0d01-3aac-af32-5ad72f3aee6f","vulnerability":{"id":"CVE-2025-66622","description":"matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate\u0027s sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.","datePublished":"Dec 9, 2025, 2:07:18 AM","dateUpdated":"Dec 9, 2025, 4:02:47 PM","status":"PUBLISHED","baseScore":1.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","references":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3\nhttps://github.com/matrix-org/matrix-rust-sdk/pull/5924\nhttps://github.com/matrix-org/matrix-rust-sdk/commit/4ea0418abefab2aa93f8851a4d39c723e703e6b0\nhttps://rustsec.org/advisories/RUSTSEC-2025-0135.html\n","enisa_id":"EUVD-2025-201827\n","assigner":"GitHub_M","epss":0.41,"dataProcessed":"Oct 29, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"9d6c4540-3203-3719-846a-643fd585dd39","product":{"name":"matrix-rust-sdk","vendor":{"name":"matrix-org"}},"product_version":"\u003c 0.16.0"}],"vulnerabilityVendor":[{"id":"ee249235-e656-3140-b52c-8a3a1e1387b7","vendor":{"name":"matrix-org"}}]}},{"id":"f32f7e38-15c1-3047-ad5c-3fdd805bc118","vulnerability":{"id":"GHSA-jj6p-3m75-g2p3","description":" matrix-sdk-base denial of service via custom m.room.join_rules event values","datePublished":"Dec 8, 2025, 10:07:47 PM","dateUpdated":"Dec 9, 2025, 7:17:14 PM","baseScore":0.0,"references":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-jj6p-3m75-g2p3\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-66622\nhttps://github.com/matrix-org/matrix-rust-sdk/pull/5924\nhttps://github.com/matrix-org/matrix-rust-sdk/commit/4ea0418abefab2aa93f8851a4d39c723e703e6b0\nhttps://github.com/matrix-org/matrix-rust-sdk\nhttps://rustsec.org/advisories/RUSTSEC-2025-0135.html\n","enisa_id":"EUVD-2025-201827\n","aliases":"CVE-2025-66622\nGHSA-jj6p-3m75-g2p3\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}