Is CVE-2026-63096 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63096 being exploited in the wild.

How severe is CVE-2026-63096?

Medium severity, with a CVSS score of 5.8, published 17 July 2026.

Is there a fix for CVE-2026-63096?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-63096 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63096?

Check whether you run Matrix.org Dendrite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63096: Matrix.org Dendrite SSRF in legacy media download endpoint

CVE-2026-63096 · Severity: medium · CVSS 5.8 · Published 2026-07-17

Dendrite, a communication server for the Matrix protocol, contains a security flaw in its media download system. An unauthenticated attacker can trick the server into making unauthorized connections to other computers on the internal network. This allows the attacker to map out private infrastructure and identify active internal services that should not be visible from the internet.

Technologies: Matrix.org Dendrite. Vendors: Matrix.org.

Quick answers

Is CVE-2026-63096 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63096 being exploited in the wild.
How severe is CVE-2026-63096?: Medium severity, with a CVSS score of 5.8, published 17 July 2026.
Which products and versions are affected?: Matrix.org Dendrite <= 0.13.8.
Is there a fix for CVE-2026-63096?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-63096 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63096?: Check whether you run Matrix.org Dendrite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A server-side request forgery (SSRF) vulnerability exists in Dendrite through version 0.13.8 within the legacy media download endpoint (_matrix/media/r0/download). The vulnerability is caused by insufficient validation of the 'serverName' parameter, which allows an unauthenticated remote attacker to force the server to initiate outbound TLS connections to arbitrary hosts and ports. By analyzing distinguishable error responses and leaked internal IP addresses in error messages, an attacker can perform blind port scanning and enumerate internal network topology. The product repository was archived in late 2024, and users should verify if patches are available or migrate to supported Matrix homeserver implementations.

Affected products

Matrix.org Dendrite <= 0.13.8

Timeline

2024-11-25: other: Project repository archived by owner
2026-07-17: disclosed: Vulnerability disclosed and CVE assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.