CVE-2026-45078
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
May 28, 2026
CISA due date
—
The record
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and lead to other requests failing, causing other users to be denied service. This vulnerability is fixed in 1.152.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | matrix-synapse | 0 | 1.153.0-2.1 |
Related vulnerabilities
- CVE-2026-45076 Synapse is an open source Matrix homeserver implementation. Also affects matrix-synapse
- CVE-2026-24044 Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the… Also affects matrix-synapse
- CVE-2024-53867 Synapse is an open-source Matrix homeserver. Also affects matrix-synapse
- CVE-2024-37302 Synapse denial of service through media disk space consumption Also affects matrix-synapse
- CVE-2024-37303 Synapse's unauthenticated writes to the media repository allow planting of problematic… Also affects matrix-synapse
- CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external… Also affects matrix-synapse
- CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion Also affects matrix-synapse
- CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync` Also affects matrix-synapse