{"id":"RUSTSEC-2025-0135","revision":"2d879df0e1224ca19cc757e03a31f583","records":[{"revision":"2d879df0e1224ca19cc757e03a31f583","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2025-0135","aliases":["CVE-2025-66622","GHSA-jj6p-3m75-g2p3"],"title":"matrix-sdk-base: Denial of service due to custom `m.room.join_rules` events","description":"The matrix-sdk-base crate is unable to handle responses that include custom\nm.room.join_rules values due to a serialization bug.\n\nThis can be exploited to cause a denial-of-service condition, if a user is\ninvited to a room with non-standard join rules, the crate's sync process will\nstall, preventing further processing for all rooms.","state":0,"publishedAt":"2025-12-08T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:07.3551623+00:00","affected":[{"ecosystem":"crates.io","name":"matrix-sdk-base","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.16.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/matrix-sdk-base","https://rustsec.org/advisories/RUSTSEC-2025-0135.html","https://github.com/matrix-org/matrix-rust-sdk/pull/5924"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2025-0135","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2025-0135","identifiers":["RUSTSEC-2025-0135","CVE-2025-66622","GHSA-jj6p-3m75-g2p3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}