https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:26:08.088765+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-45076 CVE-2026-45076 — Synapse pagination denial of service 2026-10-02T17:26:08.090454+00:00

Affected: element-hq synapse

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.

 https://cve.radiocsirt.org/vuln/ghsa-6qf2-7x63-mm6v GHSA-6qf2-7x63-mm6v — Synapse pagination Denial of Service 2026-10-02T17:26:08.090505+00:00

Affected: PyPI: matrix-synapse

### Impact

In federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients.

Clients could therefore fail to display room history.

### Patches

Update to Synapse 1.152.1 or later.

### Workarounds

There are no known workarounds for this issue.

### Identifiers

- ELEMENTSEC-2025-1636

### For more information

If you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).