CVE-2025-48937

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-489389.8go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions CVE-2025-489394.2tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js wh CVE-2025-48945.9A vulnerability classified as problematic was found in calmkart Django-sso-server up to 057247929a94ffc358788a37ab99e391379a4d15. This vulne CVE-2025-489407.2MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which all CVE-2025-489415.3MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which al CVE-2025-489426.5vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/comp CVE-2025-489436.5vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (CVE-2025-489446.5vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used CVE-2025-489458.2pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asyn CVE-2025-489463.7liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version CVE-2025-489477.7The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through CVE-2025-489486.5Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allow