Is CVE-2026-45078 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45078 being exploited in the wild.

How severe is CVE-2026-45078?

Medium severity, with a CVSS score of 5.5, published 28 May 2026.

Which products and versions are affected?

Element Synapse < 1.152.1; matrix-synapse (PyPI) < 1.152.1, ECOSYSTEM:introduced=0,fixed=1.152.1.

Is there a fix for CVE-2026-45078?

Yes. matrix-synapse (PyPI): upgrade to 1.152.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45078 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45078?

Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45078: Element Synapse CPU starvation denial of service

Q: Which products and versions are affected?

Element Synapse < 1.152.1; matrix-synapse (PyPI) < 1.152.1, ECOSYSTEM:introduced=0,fixed=1.152.1.

Q: Is there a fix for CVE-2026-45078?

Yes. matrix-synapse (PyPI): upgrade to 1.152.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45078 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45078?

Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45078 · Severity: medium · CVSS 5.5 · Published 2026-05-28

Synapse is a popular server implementation for the Matrix communication protocol. A vulnerability has been identified where a registered user can perform actions that consume excessive processor resources, potentially causing the server to slow down or crash for all other users. This results in a denial of service, preventing legitimate users from sending or receiving messages. Organizations that do not strictly trust every registered user on their server are at risk.

Technologies: Element Synapse, matrix-synapse (PyPI). Vendors: Element, PyPI.

Quick answers

Is CVE-2026-45078 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45078 being exploited in the wild.
How severe is CVE-2026-45078?: Medium severity, with a CVSS score of 5.5, published 28 May 2026.
Which products and versions are affected?: Element Synapse < 1.152.1; matrix-synapse (PyPI) < 1.152.1, ECOSYSTEM:introduced=0,fixed=1.152.1.
Is there a fix for CVE-2026-45078?: Yes. matrix-synapse (PyPI): upgrade to 1.152.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45078 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45078?: Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-synapse (PyPI): upgrade to 1.152.1 or later
```
pip install "matrix-synapse>=1.152.1"
```

Technical details

A resource consumption vulnerability (CWE-400/CWE-770) exists in Synapse's WorkerLock mechanism. Authenticated local users can trigger requests that cause the server to starve other processes of CPU cycles, leading to request failures and service denial. The root cause involves unbounded or excessively large retry intervals in WorkerLock that could eventually lead to integer conversion errors (ValueError) or unrealistic wait times. Attackers require a valid account on the homeserver to exploit this. The issue is mitigated in version 1.152.1 by capping WorkerLock timeout intervals to 60 seconds.

Affected products

Matrix.org Synapse < 1.152.1

Identifiers

CVE-2026-45078
GHSA-8q93-326v-3m7g
PYSEC-2026-191

Timeline

2026-05-05: patched: Fix merged into develop branch
2026-05-08: disclosed: Initial advisory publication
2026-05-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.