# CVE-2026-45076: Matrix Synapse denial of service in room history pagination

Source: https://junglewise.ai/threats/cve-2026-45076-matrix-synapse-denial-of-service-in-room-history-pagination  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-45076 · Severity: medium · CVSS 4 · Published 2026-05-28

Synapse is a server used for the Matrix communication protocol. A vulnerability exists where a malicious server in a shared chat room can send specially crafted data that prevents users from viewing their chat history. This results in a partial service outage for affected users, as they will be unable to scroll back through previous messages.

Technologies: [Element Synapse](https://junglewise.ai/threats/technologies/synapse), [matrix-synapse (PyPI)](https://junglewise.ai/threats/technologies/matrix-synapse). Vendors: [Element](https://junglewise.ai/threats/vendors/element), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-45076 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45076 being exploited in the wild.

**How severe is CVE-2026-45076?** Medium severity, with a CVSS score of 4, published 28 May 2026.

**Which products and versions are affected?** Element Synapse < 1.152.1; matrix-synapse (PyPI) < 1.152.1, ECOSYSTEM:introduced=0,fixed=1.152.1.

**Is there a fix for CVE-2026-45076?** Yes. matrix-synapse (PyPI): upgrade to 1.152.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45076 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45076?** Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-synapse (PyPI): upgrade to 1.152.1 or later

  ```sh
  pip install "matrix-synapse>=1.152.1"
  ```


## Technical details

A denial of service vulnerability exists in Synapse's handling of federated room events. Malicious homeservers can craft specific room events that interfere with the pagination process. When a client attempts to fetch older messages (paginate), the server fails to provide the full history. This is categorized as improper input validation (CWE-20). The issue is fixed in version 1.152.1.

## Affected products

- Element Synapse < 1.152.1

## Identifiers

- CVE-2026-45076
- GHSA-6qf2-7x63-mm6v
- PYSEC-2026-194

## Timeline

- 2026-05-08: disclosed
- 2026-05-08: patched: Version 1.152.1 released
- 2026-05-14: advisory

## References

- [https://github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v](https://github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v)
- [https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2026-194.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2026-194.yaml)
- [https://api.github.com/repos/element-hq/synapse/security-advisories/GHSA-6qf2-7x63-mm6v](https://api.github.com/repos/element-hq/synapse/security-advisories/GHSA-6qf2-7x63-mm6v)

## Related threats

- [PYSEC-2026-2620 - matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG](https://junglewise.ai/threats/cve-2019-11842-matrix-sydent-and-matrix-synapse-use-cryptographically-weak-prng)
- [PYSEC-2026-1614 - Synapse vulnerable to federation denial of service via malformed events](https://junglewise.ai/threats/cve-2025-30355-synapse-vulnerable-to-federation-denial-of-service-via-malformed)
- [PYSEC-2026-1610 - Synapse Matrix has a partial room state leak via Sliding Sync](https://junglewise.ai/threats/cve-2024-53867-synapse-matrix-has-a-partial-room-state-leak-via-sliding-sync)
- [Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders](https://junglewise.ai/threats/cve-2024-53863-synapse-can-be-forced-to-thumbnail-unexpected-file-formats)
- [PYSEC-2026-1611 - Synapse allows a a malformed invite to break the invitee's `/sync`](https://junglewise.ai/threats/cve-2024-52815-synapse-allows-a-a-malformed-invite-to-break-the-invitee-s-sync)