LiveActive security incident?Get immediate response
CVE Record

CVE-2022-31052: URL previews can crash Synapse media repositories or Synapse monoliths

Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether. It is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for. Remote users are not able to exploit this directly, because the URL preview endpoint is authenticated. Deployments with `url_preview_enabled: false` set in configuration are not affected. Deployments with `url_preview_enabled: true` set in configuration **are** affected. Deployments with no configuration value set for `url_preview_enabled` are not affected, because the default is `false`. Administrators of homeservers with URL previews enabled are advised to upgrade to v1.61.1 or higher. Users unable to upgrade should set `url_preview_enabled` to false.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-31052 is a denial-of-service flaw in Matrix Synapse URL previews. A crafted or problematic web page preview can exhaust stack space and may crash the Synapse process. The issue affects availability, not confidentiality or integrity, and only matters where URL previews are enabled on vulnerable Synapse versions.

Executive priority

Treat as a moderate availability risk for Matrix services with URL previews enabled. Prioritize upgrade or disablement where chat availability is business-critical, especially on public or federated homeservers.

Technical view

Synapse versions before 1.61.1 can hit unbounded recursion during URL preview processing, causing stack exhaustion. The preview endpoint is authenticated, but exposure can include malicious local users or remote users whose URLs trigger automatic previews by local clients. CWE-674 is listed.

Likely exposure

Likely exposure is Matrix Synapse homeservers before 1.61.1 with `url_preview_enabled: true`, including media repositories or monolith deployments. Deployments with previews disabled, or no value set because the default is false, are not affected according to the advisory.

Exploitation context

The source bundle says malicious exploitation is possible, but does not cite active exploitation, and KEV is false. Remote users cannot directly call the authenticated preview endpoint, but may indirectly trigger previews when local users' clients request them.

Researcher notes

The evidence is strongest for affected versions, configuration dependency, and vendor remediation. The bundle does not provide active exploitation evidence or affected non-Synapse products. Avoid assuming direct unauthenticated remote exploitation.

Mitigation direction

  • Upgrade Synapse to version 1.61.1 or later.
  • If unable to upgrade, set `url_preview_enabled` to false.
  • Confirm distro-managed Synapse packages include the vendor fix.
  • Check Matrix/Synapse vendor guidance before relying on alternate mitigations.

Validation and detection

  • Inventory Synapse versions across homeserver and media repository deployments.
  • Check configuration for `url_preview_enabled: true`.
  • Confirm the running service is Synapse 1.61.1 or later after upgrade.
  • Review service logs for crashes or restarts tied to URL preview requests.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-674: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-31052 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2022-31052Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
matrix-orgsynapse< 1.61.1Listed
Weakness

CWE details

CWE-674

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-674 · source CWE mapping

Uncontrolled Recursion

Uncontrolled Recursion represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs