Upcoming coordinated security fix for all Matrix server implementations
Hi all, Over the last 6 months a major project has been underway by the Element server team and the Matrix.org Foundation security team to investigate “state resets”: scenarios where Matrix’s state resolution algorithm can give unexpected results. As part of this work we’ve identified two high severity protocol vulnerabilities (CVE-2025-49090; the other not yet allocated a CVE). Given the security implications of a federation protocol vulnerability, we’ve shared details under embargo over the