CVE-2025-66622
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-09

Last updated on: 2026-03-17

Assigner: GitHub, Inc.

Description
matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-09
Last Modified
2026-03-17
Generated
2026-06-16
AI Q&A
2025-12-09
EPSS Evaluated
2026-06-15
NVD
CVE-2025-66622
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
matrix matrix-rust-sdk to 0.16.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-755 The product does not handle or incorrectly handles an exceptional condition.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in matrix-sdk-base versions 0.14.1 and prior, where the software cannot properly handle responses containing custom m.room.join_rules values due to a serialization bug. If a user is invited to a room with non-standard join rules, the synchronization process stalls, causing a denial-of-service condition that prevents further processing for all rooms.

Impact Analysis

This vulnerability can cause a denial-of-service condition in the matrix-sdk-base client library. Specifically, if a user is invited to a room with non-standard join rules, the synchronization process will stall and stop processing updates for all rooms, potentially disrupting normal application functionality.

Mitigation Strategies

Upgrade matrix-sdk-base to version 0.16.0 or later, as this version fixes the serialization bug causing the denial-of-service condition.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66622. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart