{"id":"CVE-2019-11340","aliases":["GHSA-q9h8-gpw5-c95c","PYSEC-2026-843"],"url":"https://o3.security/vulnerability/CVE-2019-11340","summary":"Matrix Sydent mishandles emails","details":"util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.","published":"2019-04-19T14:29:00.417Z","modified":"2026-07-08T16:07:40.269474Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"matrix-sydent","fixedVersion":"1.0.2"}],"fix":{"url":"https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fc","label":"matrix-org/sydent@4e1cfff"},"references":[{"type":"ADVISORY","url":"https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/"},{"type":"ADVISORY","url":"https://twitter.com/matrixdotorg/status/1118934335963500545"},{"type":"FIX","url":"https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fc"},{"type":"FIX","url":"https://github.com/matrix-org/sydent/compare/7c002cd...09278fb"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T16:07:40.269474Z"}}