CVE-2026-45076
Synapse pagination denial of service
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Synapse pagination denial of service
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
- Record
CVE-2026-45076- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-32934
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
- Record
EUVD-2026-32934- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6qf2-7x63-mm6v
Synapse pagination Denial of Service
Impact
In federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients.
Clients could therefore fail to display room history.
Patches
Update to Synapse 1.152.1 or later.
Workarounds
There are no known workarounds for this issue.
Identifiers
- ELEMENTSEC-2025-1636
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
- Record
GHSA-6qf2-7x63-mm6v- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
- Record
CVE-2026-45076- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-45076
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
- Record
ALPINE-CVE-2026-45076- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-06
OSV
Synapse pagination denial of service
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
- Record
CVE-2026-45076- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-45076
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
- Record
DEBIAN-CVE-2026-45076- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-6qf2-7x63-mm6v
Synapse pagination Denial of Service
Impact
In federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients.
Clients could therefore fail to display room history.
Patches
Update to Synapse 1.152.1 or later.
Workarounds
There are no known workarounds for this issue.
Identifiers
- ELEMENTSEC-2025-1636
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
- Record
GHSA-6qf2-7x63-mm6v- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2026-194
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
- Record
PYSEC-2026-194- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-45076
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
- Record
UBUNTU-CVE-2026-45076- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10898-1 No score
matrix-synapse-1.153.0-2.1 on GA media
These are all security issues fixed in the matrix-synapse-1.153.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10898-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-synapsePyPI |
before 1.152.1 | 1.152.1 |
synapseAlpine:v3.23 |
before 1.152.1-r0 | 1.152.1-r0 |
synapseAlpine:v3.24 |
before 1.152.1-r0 | 1.152.1-r0 |
matrix-synapsePyPI |
before 1.152.1, plus listed versions 0.33.50.33.5.10.33.60.33.6rc10.33.7 Show 45 moreShow less0.33.7rc10.33.7rc20.33.80.33.8rc20.33.90.34.00.34.0.10.34.0rc10.34.0rc20.34.1.10.99.00.99.0rc10.99.0rc20.99.0rc30.99.0rc40.99.10.99.1.10.99.1rc10.99.1rc20.99.20.99.2rc10.99.30.99.3.10.99.3.20.99.3rc10.99.40.99.4rc10.99.50.99.5.10.99.5.20.99.5rc11.0.01.0.0rc11.0.0rc21.0.0rc31.1.01.1.0rc11.1.0rc21.10.01.10.0rc11.10.0rc21.10.0rc31.10.0rc51.10.11.100.0 |
1.152.1 |
matrix-synapseUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.19.2+dfsg-60.24.0+dfsg-10.24.0+dfsg-1ubuntu0.1~esm10.24.0+dfsg-1ubuntu0.1~esm4 |
None known |
matrix-synapseUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.3.0-11.4.0-11.5.0-11.5.1-11.6.0-1 Show 12 moreShow less1.6.1-11.7.0-21.7.1-11.7.2-11.7.3-11.8.0-11.9.0-11.9.1-11.10.0-11.10.0-21.11.0-11.11.0-1ubuntu0.1~esm2 |
None known |
matrix-synapseUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.39.0-11.47.0-21.47.1-11.48.0-11.49.0-1 Show 7 moreShow less1.49.2-11.50.1-11.50.2-11.51.0-11.52.0-11.53.0-11.53.0-1ubuntu0.1~esm2 |
None known |
matrix-synapseUbuntu:24.04:LTS |
All versions, plus listed versions 1.90.0-11.100.0-1ubuntu1 |
None known |
matrix-synapseopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.153.0-2.1 | 1.153.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts, references | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-45076 is a medium vulnerability (CVSS 5.1) in Element Synapse, published May 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in matrix-synapse 1.152.1.
References
github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v
nvd.nist.gov/vuln/detail/CVE-2026-45076
security.alpinelinux.org/vuln/CVE-2026-45076
Left out here: 452 versions. The JSON record has them.