PT-2026-41158 · Synapse · Synapse

Published 2026-05-14 · Updated 2026-06-04 · CVE-2026-45076

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.152.1

Description In federated rooms, malicious homeservers can craft room events that prevent the server from providing full history to paginating clients. This can result in clients failing to display the room history.

Recommendations Update to version 1.152.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-45076

GHSA-6QF2-7X63-MM6V

OPENSUSE-SU-2026:10898-1

PYSEC-2026-194

Affected Products

Synapse

References · 16

• https://github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45076 · Security Note
• https://ubuntu.com/security/CVE-2026-45076 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45076 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45076 · Security Note
• https://osv.dev/vulnerability/GHSA-6qf2-7x63-mm6v · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45076 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10898-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45076 · Vendor Advisory
• https://github.com/element-hq/synapse · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2026-194.yaml · Note
• https://suse.com/security/cve/CVE-2026-45078 · Note
• https://suse.com/security/cve/CVE-2026-45076 · Note
• https://t.me/cveNotify/165058 · Telegram Post