CVE-2026-45076

MEDIUM

Synapse pagination denial of service

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-45076 has a selected CVSS score of 5.1 (medium).

Description

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 2, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

synapse

Browse element-hq / synapse
CVE List< 1.152.1affected

matrix-synapse

Browse PyPI / matrix-synapse
GitHub AdvisoryBefore 1.152.1 · Fixed in 1.152.1affected

References

4