Threats affecting pkg:github/element-hq/synapse

CVE-2026-45078 is a medium severity vulnerability in element-hq's Synapse Matrix homeserver prior to version 1.152.1. It allows local authenticated users to cause resource starvation by consuming excessive CPU, which can lead to denial of service for other users. The issue arises from allocation of resources without limits or throttling. This vulnerability has been fixed in Synapse version 1.152.1.

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.