CVE-2026-45076: Synapse pagination Denial of Service

May 14, 2026 (updated June 9, 2026)

In federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients.

Clients could therefore fail to display room history.

References

github.com/advisories/GHSA-6qf2-7x63-mm6v
github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v
github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2026-194.yaml
nvd.nist.gov/vuln/detail/CVE-2026-45076

Code Behaviors & Features

Detect and mitigate CVE-2026-45076 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →