CVE-2026-45078

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and lead to other requests failing, causing other users to be denied service. This vulnerability is fixed in 1.152.1.

CVSS 4.0

6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-25)

CWE

CWE-770

Published

2026-05-28

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• element:synapse

Packages (OSV)

References

• https://github.com/element-hq/synapse/security/advisories/GHSA-8q93-326v-3m7g

Check your stackJSON