CVE-2026-45076: Synapse Federated Room History Availability Flaw

Technical summary

CVE-2026-45076 is an input validation vulnerability (CWE-20) affecting Synapse versions prior to 1.152.1. In federated Matrix rooms, untrusted homeservers can construct malformed room events that cause the affected Synapse instance to fail history pagination operations. The flaw lies in insufficient validation of event structure when processing federated room state, allowing remote actors to trigger denial-of-service conditions against history retrieval. The CVSS 3.1 vector (2.7 LOW) reflects high access requirements (PR:H) and localized availability impact without affecting confidentiality or integrity.

Business impact

Organizations running Synapse homeservers in federated environments face degraded user experience during historical message retrieval. Users may be unable to see past conversations, potentially impacting compliance scenarios where audit trails or message archives are required for regulatory purposes. However, the impact is limited to availability of archived data; live communication and forward messaging are not affected. The requirement for a malicious federated peer significantly constrains real-world attack surface.

Affected systems

Element Synapse versions prior to 1.152.1 are affected. Only deployments in federated Matrix networks are at risk; standalone homeservers without federation enabled are not impacted. The vulnerability requires an attacker to control or compromise a federated peer homeserver.

Exploitability

Exploitation requires administrative control or compromise of a federated homeserver peer and the ability to craft and inject malformed room events into shared rooms. This is not an unauthenticated remote vulnerability; the attacker must already possess federation privileges. No public exploit code is known to exist, and the low CVSS score reflects the high privilege barrier and limited scope of impact.

Remediation

Upgrade Synapse to version 1.152.1 or later. Organizations should also review federation trust relationships and implement network-level controls to limit federation to trusted homeserver instances. If immediate patching is not feasible, restricting federation scope or disabling federation temporarily can mitigate exposure.

Patch guidance

Apply Synapse 1.152.1 as soon as practical. Verify the patch version in your deployment environment and consult the Element/Synapse official release notes to confirm the fix is included. For organizations on extended support timelines, check whether backports are available for your supported release series. Test the upgrade in a staging environment before deploying to production to ensure no compatibility issues with existing room state or federation peers.

Detection guidance

Monitor Synapse logs for pagination failures or incomplete history retrieval errors, particularly in federated rooms. Implement alerts on elevated error rates for the /messages API endpoint or related history-fetch operations. Network-level detection is challenging without endpoint visibility; focus detection efforts on server-side logging and alerting for abnormal pagination behavior correlated with specific federation peers.

Why prioritize this

This vulnerability receives low priority despite federated deployment scenarios. The requirement for a malicious federated peer, combined with limited scope (availability only), and the straightforward patch path justify deferral past high-impact issues. Prioritize patching if your organization maintains strict audit trail requirements or operates in regulated industries where historical message availability is compliance-critical.

Risk score, explained

The CVSS 3.1 score of 2.7 (LOW) reflects: network-accessible attack vector (AV:N), but high privilege requirement (PR:H) limiting real-world exploitability; low complexity (AC:L) of crafting malicious events; no impact to confidentiality (C:N) or integrity (I:N); and minimal availability impact (A:L) scoped to historical data retrieval rather than service disruption. The score appropriately penalizes an attack requiring federated peer compromise.

Frequently asked questions