CVE-2026-45076 MEDIUM

CVE-2026-45076: Synapse pagination denial of service

Vendor Element-Hq
Product synapse
Weakness CWE-20 · Input validation
Published May 28, 2026
Last update June 2, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.

Key dates

02Disclosure timeline

May 28, 2026 CVE published
June 2, 2026 Record updated