Rust advisories / matrix-sdk-crypto
Vulnerability HighRUSTSEC-2022-0085 · matrix-sdk-crypto
RUSTSEC-2022-0085: matrix-sdk Impersonation of room keys
Short answerA security vulnerability in the matrix-sdk-crypto crate: matrix-sdk Impersonation of room keys. High severity (CVSS 7.5). Fixed in 0.6.0: update to a fixed version.
| Crate | matrix-sdk-crypto |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.6.0. |
| Fixed in | 0.6.0 |
| Severity | High, CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Published | 2022-09-29 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2022-39252, GHSA-vp68-2wrm-69qm |
What to do
- See which version you have:
cargo tree -i matrix-sdk-crypto(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p matrix-sdk-crypto. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplematrix-sdk-crypto = "0.6.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack.
References
- Package: crates.io/crates/matrix-sdk-crypto
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0085.html
- Web: github.com/matrix-org/matrix-rust-sdk/commit/093fb5d0aa21c0b5eaea6ec96b477f1075271cbb
- Web: github.com/matrix-org/matrix-rust-sdk/commit/41449d2cc360e347f5d4e1c154ec1e3185f11acd
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for matrix-sdk-crypto
- VulnerabilityRUSTSEC-2024-0356 · 2024-07-18`UserIdentity::is_verified` not checking verification status of own user identity while performing the check
- NoticeRUSTSEC-2024-0434 · 2024-01-07 Missing facility to signal rotation of a verified cryptographic identity
- Vulnerability MediumRUSTSEC-2025-0041 · 2025-06-11matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
- VulnerabilityRUSTSEC-2026-0159 · 2026-06-03Sender-binding gaps in to-device messages
- VulnerabilityRUSTSEC-2026-0318 · 2026-09-29Sending custom to-device messages may panics
- VulnerabilityGHSA-9ggc-845v-gcgv · 2024-05-13matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
Up next
Same cratematrix-sdk-crypto: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?