Secure Chat Darling Matrix Admits Pair Of 'high Severity' Protocol Flaws Need Painful Fixes

Updated The maintainers of the federated secure chat protocol Matrix are warning users of a pair of "high severity protocol vulnerabilities," addressed in the latest version, saying patching them requires a breaking change in servers and clients.

"Last month we issued 'pre-disclosure: upcoming coordinated security fix for all Matrix server implementations,' describing a coordinated release to fix two high severity protocol vulnerabilities," Jim Mackenzie, veep for trust and safety at the Matrix.org Foundation, said.

"That release is now available as of 1700 UTC on August 11, 2025. Server updates are now available, and MSCs & spec updates will follow on Thursday, August 14, 2025, bringing us to version 1.16 of the spec later in the month, and introducing room version 12."

Matrix, which boasted a conservatively estimated 60 million users, plus around 500,000 government users, back in 2022, isn't a chat platform; it's an open standard for a real-time communication protocol built atop HTTP and WebRTC, designed to make it easy for client apps from any vendor to interoperate using a decentralized federation system.

Founded by Matthew Hodgson and Amandine Le Pape, who now serve as chief exec and chief operating officer of Matrix commercialisation firm Element, it promises secure real-time communication without the usual vendor tie-in.

Hodgson has been vocal in his criticism of rival chat platforms, which he has said often provide little more than lip-service to security: he singled out Telegram following its chief's arrest in France last year, and back in June disclaimed Elon Musk's XChat, launched in an attempt to win users back to the platform formerly known as Twitter, as "just another centralized platform where users have zero control over their data."

Vulnerabilities, then, are a source of embarrassment for a platform which bills itself as more secure than the competition - though there are, at least, mitigations involved. According to the Matrix.org Foundation, the non-profit which hosts the project's "homeserver," says those running a single Matrix instance with no federation to other servers are at little risk, and "there is nothing you need to do urgently."

• Proton bashes Apple and joins antitrust suit that seeks to throw the App Store wide open
• Signal chat app clone used by Signalgate's Waltz was apparently an insecure mess
• The White House could end UK's decade-long fight to bust encryption
• Security pros are drowning in threat-intel data and it's making everything more dangerous

Those running with "restricted federation" to only trusted servers can likewise be relatively lax in addressing the vulnerabilities - although the Foundation notes that "if you do not fully trust all of the homeservers in this restricted federation" then "you should update your server as soon as possible."

The biggest impact is to servers participating in "open, unrestricted federation," in which any server is able to connect – and thus make use of the vulnerabilities. In a "pre-disclosure" from July, however, Hodgson claimed that the two "high security" protocol vulnerabilities "are not Critical Severity vulnerabilities, [so] there is no requirement for room admins to upgrade rooms immediately."

Those who do want to ensure they are protected against attack, the exact nature of which has not yet been publicly disclosed, will need to upgrade their Matrix server to a version which supports "Room Version 12" – newly added in the Matrix specification version 1.16 – and then manually upgrade each room to said new version; users, meanwhile, will also need to upgrade their clients in order to connect to servers set to Room Version 12.

Matrix has confirmed that protocol implementers Conduit, Continuwuity, ejabberd, Dendrite, Rocket.chat, Synapse, Synapse Pro, and Tuwunel will be "releasing fixes shortly," and that the matrix.org homeserver will move to Room Version 12 some time in September.

"There needs to be enough time to allow clients and servers participating in your room to support v12 before upgrading your room," Mackenzie advised.

The full announcement is available on the Matrix website. One vulnerability has been assigned as CVE-2025-49090, with no details yet available, while the other has yet to be assigned a CVE ID.

The Register asked Element if the vulnerabilities are under active exploitation. ®

Updated at 13.27 UTC on August 13, 2025, to add:

After publication, Matthew Hodgeson, CEO of Element got in contact to say: "These are not critical vulns, and we haven't seen them being exploited in the wild.

"This is a normal security update - albeit one which required Matrix implementations to coordinate their release so they keep interoperating smoothly. The details are under security embargo which will lift tomorrow (Aug 14) with a full explanation of the vulns, as per the pre-disclosure timeline."