CVE-2025-66622
High
Description
matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.
SeverityHigh
CVSS7.5
Exploit probability36. percentile0.4%
ProductMatrix-rust-sdk
PublishedDec 9, 2025
First seenDec 9, 2025
Weakness typeCWE-755CWE-755
How to fix
Update
- matrix matrix-rust-sdk0.16.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| matrix matrix-rust-sdk | v < 0.16.0 | 0.16.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.