CVE-2024-42369

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-674

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-42378.8A vulnerability, which was classified as critical, was found in Tenda AX1806 1.0.0.1. Affected is the function R7WebsSecurityHandler of the CVE-2024-423708.3Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow CVE-2024-423715.4The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be uti CVE-2024-423726.5Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restr CVE-2024-423735.4SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential esca CVE-2024-423748.2BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can re CVE-2024-423754.3SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that coul CVE-2024-423766.5SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges CVE-2024-423774.3SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to ins CVE-2024-423786.1Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, pote CVE-2024-42388.8A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this vulnerability is the function formSetDev CVE-2024-423804.3The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specif