Low severity2.7GHSA Advisory· Published May 28, 2026· Updated Jun 4, 2026

CVE-2026-45076

Description

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
matrix-synapsePyPI	< 1.152.1	1.152.1

Affected products

Element Hq/SynapseGHSA
Range: < 1.152.1
osv-coords3 versions
pkg:apk/chainguard/synapse pkg:pypi/matrix-synapse pkg:rpm/opensuse/matrix-synapse&distro=openSUSE%20Tumbleweed
< 1.153.0-r0+ 2 more
- (no CPE)range: < 1.153.0-r0
- (no CPE)range: < 1.152.1
- (no CPE)range: < 1.153.0-2.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-6qf2-7x63-mm6vghsaADVISORY
github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6vnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-45076ghsaADVISORY
github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2026-194.yamlghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.176
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000