The matrix-org Dendrite server through version 0.13.8 is affected by an SSRF vulnerability where an attacker can supply an unvalidated serverName parameter to the legacy media download endpoint. This allows the attacker to cause the server to open outbound TLS connections to arbitrary hosts and ports. Additionally, error responses leak internal IP addresses and provide distinguishable error classes, enabling attackers to perform blind port scanning and internal network topology enumeration. No official remediation or patch has been confirmed as of the published date.

An unauthenticated attacker can exploit this SSRF vulnerability to make the affected server connect to arbitrary external or internal network hosts and ports. This can lead to information disclosure of internal IP addresses and network topology through error message leakage. The vulnerability does not require privileges or user interaction and has a medium severity impact based on the CVSS 4.0 score of 6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network egress from the Dendrite server to trusted destinations and monitor for unusual outbound connection attempts to mitigate exploitation risk.