CVE-2026-45078

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and lead to other requests failing, causing other users to be denied service. This vulnerability is fixed in 1.152.1.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/element-hq/synapse/security/advisories/GHSA-8q93-326v-3m7g	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:element:synapse:*:*:*:*:*:*:*:*

History

26 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Synapse es una implementación de homeserver de Matrix de código abierto. Antes de 1.152.1, los usuarios locales autenticados pueden hacer que Synapse prive a otras solicitudes de CPU y provoque que otras solicitudes fallen, causando que a otros usuarios se les deniegue el servicio. Esta vulnerabilidad está corregida en 1.152.1.

Information

Published : 2026-05-28 17:16

Updated : 2026-10-26 13:10

NVD link : CVE-2026-45078

Mitre link : CVE-2026-45078

CVE.ORG link : CVE-2026-45078

JSON object : View

Products Affected

element

synapse

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-45078", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45078", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T15:31:35.828810Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "element-hq", "product": "synapse", "versions": [{"status": "affected", "version": "< 1.152.1"}]}]}], "published": "2026-05-28T17:16:31.750", "references": [{"url": "https://github.com/element-hq/synapse/security/advisories/GHSA-8q93-326v-3m7g", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and lead to other requests failing, causing other users to be denied service. This vulnerability is fixed in 1.152.1."}, {"lang": "es", "value": "Synapse es una implementaci\u00f3n de homeserver de Matrix de c\u00f3digo abierto. Antes de 1.152.1, los usuarios locales autenticados pueden hacer que Synapse prive a otras solicitudes de CPU y provoque que otras solicitudes fallen, causando que a otros usuarios se les deniegue el servicio. Esta vulnerabilidad est\u00e1 corregida en 1.152.1."}], "lastModified": "2026-10-26T13:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:element:synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30470335-8DE4-4DE9-84B0-09D11E4A2D70", "versionEndExcluding": "1.152.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}