CVE-2020-26890: 
Python vulnerability analysis and mitigation

CVE-2020-26890 affects Matrix Synapse versions before 1.20.0. The vulnerability was discovered in November 2020 and allows remote attackers to execute a denial of service attack by exploiting improper handling of non-standard JSON values (NaN, Infinity, and -Infinity) in m.room.member events (Matrix Advisory).

The vulnerability stems from Matrix Synapse erroneously permitting non-standard JSON values (NaN, Infinity, and -Infinity) in fields of m.room.member events. The issue is tracked with CVSS v3.1 Base Score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a high-severity vulnerability with network access vector and no required privileges or user interaction (NVD).

If a malformed event is accepted into the room's state, the impact is long-lasting and persists even after upgrading to a newer version. Since events are replicated to servers of other room members, the impact extends beyond the server of the event sender, potentially affecting the federation and common Matrix clients (Matrix Advisory).

The vulnerability can be exploited remotely by sending malformed JSON data to Synapse. The attack requires no special privileges or user interaction, making it relatively easy to exploit. The malformed event, once accepted, becomes part of the room state and requires manual redaction to fix (NVD).

The vulnerability was patched in Matrix Synapse version 1.20.0. If an invalid event has already been accepted into the room state, upgrading alone will not fix the issue - the event must be manually redacted. The fix required applying patches #8106 and #8291, with additional checks included in #7372 and #8124 (Matrix Advisory).