Is CVE-2026-45076 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45076 being exploited in the wild.

How severe is CVE-2026-45076?

Medium severity, with a CVSS score of 4, published 28 May 2026.

Which products and versions are affected?

Element Synapse < 1.152.1; matrix-synapse (PyPI) < 1.152.1, ECOSYSTEM:introduced=0,fixed=1.152.1.

Is there a fix for CVE-2026-45076?

Yes. matrix-synapse (PyPI): upgrade to 1.152.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45076 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-45076?

Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45076: Matrix Synapse denial of service in room history pagination

Q: Which products and versions are affected?

Element Synapse < 1.152.1; matrix-synapse (PyPI) < 1.152.1, ECOSYSTEM:introduced=0,fixed=1.152.1.

Q: Is there a fix for CVE-2026-45076?

Yes. matrix-synapse (PyPI): upgrade to 1.152.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45076 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-45076?

Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45076 · Severity: medium · CVSS 4 · Published 2026-05-28

Synapse is a server used for the Matrix communication protocol. A vulnerability exists where a malicious server in a shared chat room can send specially crafted data that prevents users from viewing their chat history. This results in a partial service outage for affected users, as they will be unable to scroll back through previous messages.

Technologies: Element Synapse, matrix-synapse (PyPI). Vendors: Element, PyPI.

Quick answers

Is CVE-2026-45076 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45076 being exploited in the wild.
How severe is CVE-2026-45076?: Medium severity, with a CVSS score of 4, published 28 May 2026.
Which products and versions are affected?: Element Synapse < 1.152.1; matrix-synapse (PyPI) < 1.152.1, ECOSYSTEM:introduced=0,fixed=1.152.1.
Is there a fix for CVE-2026-45076?: Yes. matrix-synapse (PyPI): upgrade to 1.152.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45076 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-45076?: Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-synapse (PyPI): upgrade to 1.152.1 or later
```
pip install "matrix-synapse>=1.152.1"
```

Technical details

A denial of service vulnerability exists in Synapse's handling of federated room events. Malicious homeservers can craft specific room events that interfere with the pagination process. When a client attempts to fetch older messages (paginate), the server fails to provide the full history. This is categorized as improper input validation (CWE-20). The issue is fixed in version 1.152.1.

Affected products

Element Synapse < 1.152.1

Identifiers

CVE-2026-45076
GHSA-6qf2-7x63-mm6v
PYSEC-2026-194

Timeline

2026-05-08: disclosed
2026-05-08: patched: Version 1.152.1 released
2026-05-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.