PT-2026-41159 · Synapse · Synapse

Published 2026-05-14 · Updated 2026-05-29 · CVE-2026-45078

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.152.1

Description Local authenticated users can cause the system to starve other requests of CPU resources, leading to request failures and a denial of service for other users. Homeservers that trust all their local users are not at risk.

Recommendations Update to version 1.152.1 or later. If deployed behind a reverse proxy, configure the proxy to limit the rate of user requests to prevent or increase the difficulty of the attack.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-45078

GHSA-8Q93-326V-3M7G

OPENSUSE-SU-2026:10898-1

Affected Products

Synapse

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-45078 · Security Note
• https://osv.dev/vulnerability/GHSA-8q93-326v-3m7g · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10898-1 · Vendor Advisory
• https://github.com/element-hq/synapse/security/advisories/GHSA-8q93-326v-3m7g · Note
• https://github.com/element-hq/synapse · Note
• https://github.com/element-hq/synapse/issues/19394 · Note
• https://github.com/element-hq/synapse/commit/3f58bc50dfba5768ee43ce48c5e74c25ba0b078a · Note
• https://t.me/cveNotify/165059 · Telegram Post
• https://suse.com/security/cve/CVE-2026-45076 · Note
• https://suse.com/security/cve/CVE-2026-45078 · Note