CVE-2026-45076
Low · 2.7CVSS
2.7
EPSS
0.4%
Published
May 28, 2026
CISA due date
—
The record
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | matrix-synapse | 0 | 1.153.0-2.1 |
Related vulnerabilities
- CVE-2026-45078 Synapse is an open source Matrix homeserver implementation. Also affects matrix-synapse
- CVE-2026-24044 Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the… Also affects matrix-synapse
- CVE-2024-53867 Synapse is an open-source Matrix homeserver. Also affects matrix-synapse
- CVE-2024-37302 Synapse denial of service through media disk space consumption Also affects matrix-synapse
- CVE-2024-37303 Synapse's unauthenticated writes to the media repository allow planting of problematic… Also affects matrix-synapse
- CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external… Also affects matrix-synapse
- CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion Also affects matrix-synapse
- CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync` Also affects matrix-synapse