CVE-2026-63096— Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| matrix-org | dendrite | ≤ 0.13.8 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-63096
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint
Source: NVD (National Vulnerability Database)
Vulnerability Description
Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers can exploit distinguishable error response classes and leaked internal IP addresses in error messages to perform blind port scanning and enumerate internal network topology.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| matrix-org | dendrite | 0 ~ 0.13.8 | - |
II. Public POCs for CVE-2026-63096
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63096
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-63096 (1)
Proof of Concept for CVE-2026-63096 (1)
Same Patch Batch · matrix-org · 2026-07-17 · 3 CVEs total
| CVE-2026-63095 | 6.5 MEDIUM | Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint |
| CVE-2026-63097 | 4.3 MEDIUM | Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure |
IV. Related Vulnerabilities
Same vendor: matrix-org
- CVE-2026-63097
Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State E - CVE-2026-63095
Dendrite 0.13.8 Improper Authorization via POST account/3pid - CVE-2025-66622
matrix-sdk-base is vulnerable to DoS via custom m.room.join_ - CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a - CVE-2025-59047
matrix-sdk-base has panic in the `RoomMember::normalized_pow
Same weakness: CWE-918
- CVE-2026-16223
1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationCo - CVE-2026-16222
1Panel-dev CordysCRM Third Party Endpoint TokenService.java - CVE-2026-16196
Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP ser - CVE-2026-16194
zhayujie CowAgent web_fetch.py WebFetch.execute server-side - CVE-2026-16128
zevorn rt-claw http_request swarm.c receiver_thread server-s
V. Comments for CVE-2026-63096
No comments yet