-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-synapse | pip | < 0.28.1 | 0.28.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key functions: 1) event_from_pdu_json in federation_base.py lacked validation for depth parameter type and range, allowing injection of malicious values. 2) create_new_client_event in message.py generated events with potentially unbounded depth values. The patch adds depth validation in federation_base.py (integer check and MAX_DEPTH cap) and depth capping in message.py, directly addressing these vulnerable code paths. Both functions are explicitly mentioned in vulnerability descriptions and patch diffs, with CWE-20 (Input Validation) alignment.