Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it's likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade syncthing | Aug 22, 2024 | Apr 6, 2021 |
| Debian | — | Upgrade syncthing | Jul 30, 2024 | Apr 6, 2021 |
| Freebsd | — | Upgrade syncthing | Nov 4, 2022 | Apr 12, 2021 |
| Suse | — | Upgrade syncthing-relaysrvUpgrade syncthing | May 9, 2021 | Apr 6, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 6, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub