# CVE-2024-37302: Element Synapse denial of service via media disk space consumption

Source: https://junglewise.ai/threats/cve-2024-37302-element-synapse-denial-of-service-via-media-disk-space  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-12-03. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2024-37302 · Severity: high · CVSS 7.5 · Published 2024-12-03

Synapse, a popular server for the Matrix communication protocol, is vulnerable to an attack that can crash the service by filling up its storage space. An unauthenticated attacker can force the server to download and store massive amounts of media from remote sources, eventually exhausting disk space. This can lead to a total service outage, preventing users from sending messages or accessing the platform.

Technologies: [Element Synapse](https://junglewise.ai/threats/technologies/synapse), [matrix-synapse (PyPI)](https://junglewise.ai/threats/technologies/matrix-synapse). Vendors: [Element](https://junglewise.ai/threats/vendors/element), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-37302 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-37302 being exploited in the wild.

**How severe is CVE-2024-37302?** High severity, with a CVSS score of 7.5, published 3 December 2024.

**Which products and versions are affected?** Element Synapse < 1.106; matrix-synapse (PyPI) < 1.106, ECOSYSTEM:introduced=0,fixed=1.106, ECOSYSTEM:introduced=0,fixed=1.106.0.

**Is there a fix for CVE-2024-37302?** Yes. matrix-synapse (PyPI): upgrade to 1.106, 1.106.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-37302 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2024-37302?** Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-synapse (PyPI): upgrade to 1.106, 1.106.0 or later

  ```sh
  pip install "matrix-synapse>=1.106.0"
  ```


## Technical details

Synapse versions prior to 1.106 contain a resource exhaustion vulnerability (CWE-770) in the media caching component. An unauthenticated remote attacker can exploit insufficient rate limiting to induce the server to fetch and cache large volumes of remote media files. This results in a 'disk fill' attack that can lead to the failure of media operations or the complete unavailability of the Synapse process. The vulnerability is addressed in version 1.106 by implementing a 'leaky bucket' rate limit on remote media downloads. Temporary workarounds include reducing the maximum allowed file size or moving media storage to a dedicated isolated volume.

## Affected products

- Element Synapse < 1.106

## Identifiers

- CVE-2024-37302
- GHSA-4mhg-xv73-xq2x
- PYSEC-2024-286

## Timeline

- 2024-12-03: advisory: GitHub Advisory published
- 2024-12-03: disclosed: NVD publication date

## References

- [https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x](https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x)
- [https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2024-286.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2024-286.yaml)
- [https://api.github.com/repos/element-hq/synapse/security-advisories/GHSA-4mhg-xv73-xq2x](https://api.github.com/repos/element-hq/synapse/security-advisories/GHSA-4mhg-xv73-xq2x)

## Related threats

- [PYSEC-2026-2620 - matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG](https://junglewise.ai/threats/cve-2019-11842-matrix-sydent-and-matrix-synapse-use-cryptographically-weak-prng)
- [PYSEC-2026-1614 - Synapse vulnerable to federation denial of service via malformed events](https://junglewise.ai/threats/cve-2025-30355-synapse-vulnerable-to-federation-denial-of-service-via-malformed)
- [PYSEC-2026-1610 - Synapse Matrix has a partial room state leak via Sliding Sync](https://junglewise.ai/threats/cve-2024-53867-synapse-matrix-has-a-partial-room-state-leak-via-sliding-sync)
- [Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders](https://junglewise.ai/threats/cve-2024-53863-synapse-can-be-forced-to-thumbnail-unexpected-file-formats)
- [PYSEC-2026-1611 - Synapse allows a a malformed invite to break the invitee's `/sync`](https://junglewise.ai/threats/cve-2024-52815-synapse-allows-a-a-malformed-invite-to-break-the-invitee-s-sync)