Description
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
References (1)
Core 1
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v
Scores
CVSS v3
2.7
EPSS
0.0037
EPSS Percentile
28.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-20
Status
published
Products (3)
element/synapse
< 1.152.1
element-hq/synapse
< 1.152.1
pypi/matrix-synapse
0 - 1.152.1PyPI
Published
May 28, 2026
Tracked Since
May 28, 2026