GitHub Advisoryadvisory · PyPI

GHSA-6qf2-7x63-mm6v Synapse pagination Denial of Service

MEDIUM Published 2026-05-14 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-45076
Ecosystem
PyPI
Packages
matrix-synapse
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-20
Reviewed
2026-05-14

Affected packages

• PyPI matrix-synapse: < 1.152.1 → fixed in 1.152.1

Description

Impact In federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. Patches Update to Synapse 1.152.1 or later. Workarounds There are no known workarounds for this issue. Identifiers • ELEMENTSEC-2025-1636 For more information If you have any questions or comments about this advisory, please email us at security at element.io.

Related

Alias · CVE (1)

  • CVE-2026-45076 Synapse is an open source Matrix homeserver implementation. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References