CVE-2022-41952: 
Python vulnerability analysis and mitigation

Synapse before 1.52.0 with URL preview functionality enabled would attempt to generate URL previews for media stream URLs without properly limiting connection time. The vulnerability (CVE-2022-41952) was discovered in late 2022 and affected the URL preview functionality in Matrix Synapse servers (Security Advisory).

The vulnerability allowed connections to remain active until maxspidersize (default: 10M) bytes were downloaded, potentially leading to long-lived connections to streaming media servers like Icecast. This occurred because there was no proper timeout mechanism for URL preview generation, and the server would attempt to preview any content type including streaming media (GitHub PR).

The vulnerability could cause excessive traffic and connections toward streaming media servers if their stream URL was posted to a large room with many Synapse instances that had URL preview enabled. This could potentially lead to resource exhaustion and affect server performance (Security Advisory).

The vulnerability was patched in two stages: version 1.52.0 implemented a 30-second timeout mechanism for URL preview connections, and version 1.53.0 added a content type allow list to prevent preview attempts for unsupported media types. For unpatched systems, administrators can disable URL preview functionality by setting urlpreviewenabled: false in the Synapse configuration file (Security Advisory, GitHub PR).