N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66622

CVE-2025-66622: matrix-sdk-base denial of service via custom m.room.join_rules event values

The matrix-sdk-base crate is unable to handle responses that include custom m.room.join_rules values due to a serialization bug.

This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms.

Patches

The issue is fixed in matrix-sdk-base 0.16.0.

Workarounds

Users can leave affected rooms on another client to mitigate the issue.

References

The issue was fixed in https://github.com/matrix-org/matrix-rust-sdk/pull/5924.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66622

CVE-2025-66622:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
matrix-sdk-base	rust	< 0.16.0	0.16.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service in the matrix-sdk-base crate, caused by a serialization panic when processing m.room.join_rules events with non-standard values. The analysis of the provided patches, specifically commit ba1560d22349b9d9efe1cd37554550268c8fac02, reveals the exact location of the flaw.

The file crates/matrix-sdk-base/src/room/room_info.rs contains the logic for updating a room's information based on state events received during a sync. The functions BaseRoomInfo::handle_state_event (for joined rooms) and BaseRoomInfo::handle_stripped_state_event (for invited rooms) were identified as vulnerable.

Prior to the fix, both functions would unconditionally attempt to convert the RoomJoinRules event into an internal representation using .into(). However, the underlying ruma library does not support serializing unknown or custom string variants for the JoinRule enum, causing a panic when a non-standard join_rule was received from the server. This panic would crash the sync loop, preventing the client from processing any further events for all rooms, thus causing a denial of service.

The patch rectifies this by introducing a match statement to validate the join_rule against a list of known variants before conversion. If the join_rule is a custom value, it is now skipped, and a warning is logged, preventing the crash and allowing the sync to continue. An attacker could trigger this vulnerability by inviting a victim to a room that has a state event with a custom join_rule value.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-66622: matrix-sdk-base denial of service via custom m.room.join_rules event values

Patches

Workarounds

References

CVE-2025-66622:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-66622: matrix-sdk-base denial of service via custom m.room.join_rules event values

Patches

Workarounds

References

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI