CVE-2026-45076 Synapse pagination denial of service
Malicious homeservers can prevent Synapse from providing full history to clients, causing a denial of service for room history display.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45076?
CVE-2026-45076 is a medium-severity denial of service vulnerability in element-hq synapse, published on 28 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
Weakness: CWE-20
Which versions are affected by CVE-2026-45076?
3 open source packages ship an affected version, including matrix-synapse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | All versions | 1.152.1 |
matrix-synapse PyPI | All versions | 1.152.1 |
matrix-synapse PyPI | All versions | 1.152.1 |
Products include Element Synapse.
How do I fix CVE-2026-45076?
Upgrade matrix-synapse to 1.152.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45076 being exploited?
There is no known exploitation of CVE-2026-45076 in the wild and no public exploit code.
Other vulnerabilities in element-hq synapse
Sources
Also known as GHSA-6qf2-7x63-mm6v, PYSEC-2026-194, UBUNTU-CVE-2026-45076.