Rust advisories / matrix-sdk-crypto
Vulnerability MediumRUSTSEC-2025-0041 · matrix-sdk-crypto
RUSTSEC-2025-0041: matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
Short answerA security vulnerability in the matrix-sdk-crypto crate: matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator. Medium severity (CVSS 4.9). Fixed in 0.11.1: update to a fixed version.
| Crate | matrix-sdk-crypto |
|---|---|
| Type | Vulnerability |
| Affected versions | From 0.8.0 before 0.11.1. |
| Fixed in | 0.11.1 |
| Severity | Medium, CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
| Published | 2025-06-11 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2025-48937, GHSA-x958-rvg6-956w |
What to do
- See which version you have:
cargo tree -i matrix-sdk-crypto(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p matrix-sdk-crypto. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplematrix-sdk-crypto = "0.11.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
matrix-sdk-crypto versions 0.8.0 up to and including 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user.
Although the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we consider this a High severity security issue.
References
- Package: crates.io/crates/matrix-sdk-crypto
- Advisory: rustsec.org/advisories/RUSTSEC-2025-0041.html
- Web: github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for matrix-sdk-crypto
- Vulnerability HighRUSTSEC-2022-0085 · 2022-09-29matrix-sdk Impersonation of room keys
- VulnerabilityRUSTSEC-2024-0356 · 2024-07-18`UserIdentity::is_verified` not checking verification status of own user identity while performing the check
- NoticeRUSTSEC-2024-0434 · 2024-01-07 Missing facility to signal rotation of a verified cryptographic identity
- VulnerabilityRUSTSEC-2026-0159 · 2026-06-03Sender-binding gaps in to-device messages
- VulnerabilityRUSTSEC-2026-0318 · 2026-09-29Sending custom to-device messages may panics
- VulnerabilityGHSA-9ggc-845v-gcgv · 2024-05-13matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
Up next
Same cratematrix-sdk-crypto: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?