CVE-2020-26257: 
Python vulnerability analysis and mitigation

CVE-2020-26257 affects Matrix Synapse, a reference homeserver implementation of Matrix, prior to version 1.23.1. The vulnerability was discovered and disclosed on December 9, 2020. The issue affects any server which accepts federation requests from untrusted servers (Matrix Advisory).

A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a /send_join, /send_leave, /invite or /exchange_third_party_invite request. The vulnerability has a CVSS v3.1 Base Score of 6.5 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a denial of service condition where future events will not be correctly sent to other servers over federation, impacting the server's ability to communicate with other Matrix servers (Matrix Advisory).

The vulnerability requires the attacker to have control of a Matrix homeserver that can communicate with the target server via federation. The attack can be executed by sending specially crafted federation requests with mismatched room IDs (Matrix Advisory).

The issue is fixed in Synapse version 1.23.1. As a workaround, homeserver administrators can limit access to the federation API to trusted servers using the federation_domain_whitelist configuration option (Matrix Advisory, Fedora Update).