Executive brief
Synapse is a server used for the Matrix communication protocol. A vulnerability exists where a malicious server in a shared chat room can send specially crafted data that prevents users from viewing their chat history. This results in a partial service outage for affected users, as they will be unable to scroll back through previous messages.
Technical details
A denial of service vulnerability exists in Synapse's handling of federated room events. Malicious homeservers can craft specific room events that interfere with the pagination process. When a client attempts to fetch older messages (paginate), the server fails to provide the full history. This is categorized as improper input validation (CWE-20). The issue is fixed in version 1.152.1.
Affected products
- Element Synapse < 1.152.1
Timeline
- 2026-05-08: disclosed
- 2026-05-08: patched: Version 1.152.1 released
- 2026-05-14: advisory