CVE catalog
CVE-2026-45076
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full hi
- Severity
- Medium · CVSS 5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.37% · Oct 25, 2026
A flaw was found in Synapse, an open source Matrix homeserver implementation. A remote attacker, specifically a malicious homeserver, can craft room events in federated rooms to prevent Synapse from providing full history to paginating clients. This leads to a denial of service, where clients fail to display room history. Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | synapse | Not reported | 1.152.1 | fixed |
| Ubuntu | matrix-synapse | pro | 1.39.0-1 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.47.0-2 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.47.1-1 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.48.0-1 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.49.0-1 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.49.2-1 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.50.1-1 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.50.2-1 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.51.0-1 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.52.0-1 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.53.0-1 | vulnerable |
| Ubuntu | matrix-synapse | pro | 1.53.0-1ubuntu0.1~esm2 | vulnerable |
| Ubuntu | matrix-synapse | 24.04 | 1.90.0-1 | vulnerable |
| Ubuntu | matrix-synapse | 24.04 | 1.100.0-1ubuntu1 | vulnerable |
| Opensuse | matrix-synapse | tumbleweed | 1.153.0-2.1 | fixed |
| Cpe | synapse | Not reported | 1.152.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | synapse | cpe | Not reported | 1.152.1 | Not reported | Not reported | Not reported |
| Opensuse | matrix-synapse | rpm | tumbleweed | 1.153.0-2.1 | Not reported | OPENSUSE-SU-2026:10898-1 | Not reported |
| Cpe | synapse | cpe | Not reported | 1.152.1 | Not reported | NVD-CVE-2026-45076 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [matrix-synapse]Fixed
Source package: [matrix-synapse]
Details (1)
1.159.0-1.2· x86_64 · tumbleweedFixed · Fixed:
1.153.0-2.1nvd · matrix-synapse · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10898-1.json]
- [https://github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-45076]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-45076]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-45076]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10898-1]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45076.json]
[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]