CVE-2025-48937

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48937
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48937.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48937
Aliases
Downstream
Related
Published
2025-06-10T15:32:00Z
Modified
2026-11-04T02:46:42Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
Details

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-290"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48937.json"
}
References

Affected packages

Git / github.com/matrix-org/matrix-rust-sdk

Affected ranges

Type
GIT
Repo
https://github.com/matrix-org/matrix-rust-sdk
Events
Introduced
2c43137f5faa88b9657d8ce80a1bcdd93f459517
Fixed
093c23179251d262d04cb458b2004c806100b463
Fixed
13c1d2048286bbabf5e7bc6b015aafee98f04d55
Fixed
56980745b4f27f7dc72ac296e6aa003e5d92a75b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.8.0"
                },
                {
                    "fixed": "0.11.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "13c1d2048286bbabf5e7bc6b015aafee98f04d55"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "56980745b4f27f7dc72ac296e6aa003e5d92a75b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

ruma-0.*
ruma-0.7.0
ruma-0.7.1
ruma-0.7.2
ruma-0.7.3
ruma-0.8.0
ruma-0.8.1
ruma-appservice-api-0.*
ruma-appservice-api-0.8.0
ruma-client-0.*
ruma-client-0.11.0
ruma-client-api-0.*
ruma-client-api-0.16.0
ruma-common-0.*
ruma-common-0.10.1
ruma-common-0.10.2
ruma-common-0.10.3
ruma-common-0.11.0
ruma-federation-api-0.*
ruma-federation-api-0.7.0
ruma-identity-service-api-0.*
ruma-identity-service-api-0.7.0
ruma-push-gateway-api-0.*
ruma-push-gateway-api-0.7.0
ruma-server-util-0.*
ruma-server-util-0.1.0
ruma-signatures-0.*
ruma-signatures-0.13.0
ruma-state-res-0.*
ruma-state-res-0.8.0
ruma-state-res-0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48937.json"