Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ncDg2LXE4aGctZnB4as4ABDcT

matrix-media-repo (MMR) allows a denial of service through memory exhaustion

Impact

MMR makes requests to other servers as part of normal operation, and these resource owners can return large amounts of JSON back to MMR for parsing. In parsing, MMR can consume large amounts of memory and exhaust available memory.

Patches

This is fixed in MMR v1.3.8.

Workarounds

Forward proxies can be configured to block requests to unsafe hosts. Alternatively, MMR processes can be configured with memory limits and auto-restart. Running multiple MMR processes concurrently can help ensure a restart does not overly impact users.

Permalink: https://github.com/advisories/GHSA-gp86-q8hg-fpxj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ncDg2LXE4aGctZnB4as4ABDcT
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 1 day ago
Updated: 37 minutes ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Percentage: 0.00043
EPSS Percentile: 0.1136

Identifiers: GHSA-gp86-q8hg-fpxj, CVE-2024-52791
References:

• https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-gp86-q8hg-fpxj
• https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8
• https://nvd.nist.gov/vuln/detail/CVE-2024-52791
• https://pkg.go.dev/vuln/GO-2025-3398
• https://github.com/advisories/GHSA-gp86-q8hg-fpxj

Repository: https://github.com/t2bot/matrix-media-repo
Blast Radius: 1.0

Affected Packages