Junglewise Threat Intelligence

CVE-2026-45078: Element Synapse CPU starvation denial of service

CVE-2026-45078 · Severity: medium · CVSS 5.5 · Published 2026-05-28

Technologies: Element Synapse, matrix-synapse (PyPI). Vendors: Element, Matrix.org, PyPI.

Executive brief

Synapse is a popular server implementation for the Matrix communication protocol. A vulnerability has been identified where a registered user can perform actions that consume excessive processor resources, potentially causing the server to slow down or crash for all other users. This results in a denial of service, preventing legitimate users from sending or receiving messages. Organizations that do not strictly trust every registered user on their server are at risk.

Technical details

A resource consumption vulnerability (CWE-400/CWE-770) exists in Synapse's WorkerLock mechanism. Authenticated local users can trigger requests that cause the server to starve other processes of CPU cycles, leading to request failures and service denial. The root cause involves unbounded or excessively large retry intervals in WorkerLock that could eventually lead to integer conversion errors (ValueError) or unrealistic wait times. Attackers require a valid account on the homeserver to exploit this. The issue is mitigated in version 1.152.1 by capping WorkerLock timeout intervals to 60 seconds.

Affected products

  • Matrix.org Synapse < 1.152.1

Timeline

  • 2026-05-05: patched: Fix merged into develop branch
  • 2026-05-08: disclosed: Initial advisory publication
  • 2026-05-14: advisory: GitHub Advisory published

References

Related threats