CVE-2026-45076: Synapse pagination denial of service
Impact
In federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients.
Clients could therefore fail to display room history.
Patches
Update to Synapse 1.152.1 or later.
Workarounds
There are no known workarounds for this issue.
Identifiers
- ELEMENTSEC-2025-1636
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Other sources
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/matrix-synapseto a version that resolves this vulnerability.Fixed in 1.152.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45076?
CVE-2026-45076 is a medium severity vulnerability affecting the Synapse matrix server.
How do I fix CVE-2026-45076?
You can fix CVE-2026-45076 by updating to Synapse version 1.152.1 or later.
What is the impact of CVE-2026-45076?
CVE-2026-45076 allows malicious homeservers to manipulate room events, potentially preventing clients from displaying full room history.
Which software is affected by CVE-2026-45076?
CVE-2026-45076 affects the matrix-synapse software prior to version 1.152.1.
Are there any workarounds for CVE-2026-45076?
There are currently no known workarounds for CVE-2026-45076 other than updating to the patched version.