CVE-2026-45078: Synapse Denial-of-Service via CPU Exhaustion (v1.152.1+)

Technical summary

CVE-2026-45078 is a resource exhaustion vulnerability in Synapse stemming from improper CPU allocation handling (CWE-770). Authenticated local users can trigger computationally expensive operations that monopolize CPU cycles, preventing the homeserver from servicing other requests in a timely manner. The vulnerability has a CVSS v3.1 score of 5.5 (Medium severity) with an attack vector of local, low complexity, low privileges required, no user interaction, and high availability impact.

Business impact

For organizations running Synapse as their Matrix homeserver, this vulnerability creates internal denial-of-service risk. An authenticated attacker (insider or compromised account) can disrupt service for all users on the instance, affecting real-time communication, collaboration tools, or any application relying on the Matrix federation. The impact is amplified in shared or multi-tenant deployments where a single malicious user degrades experience for many others.

Affected systems

Synapse versions prior to 1.152.1 are vulnerable. Organizations running Synapse on any platform (Linux, Docker, cloud-native deployments) are affected if they have not applied the patch. The vulnerability applies only to deployments where untrusted authenticated users have access to the homeserver.

Exploitability

Exploitability is moderate. The attack requires valid user credentials and local or network access to trigger the CPU-exhaustion condition. No complex exploitation steps, user interaction, or privilege escalation are needed—a standard authenticated user can execute the attack. The barrier to exploitation is authentication, making this primarily an insider threat or post-compromise risk in externally accessible instances.

Remediation

Upgrade Synapse to version 1.152.1 or later. Organizations unable to patch immediately should restrict matrix homeserver access to trusted users, implement network-level rate limiting on suspect accounts, and monitor CPU utilization for anomalous spikes correlated with specific users.

Patch guidance

Apply the Synapse 1.152.1 update from the official Element/Synapse release channels. Verify compatibility with your deployment architecture (bare metal, Docker, Kubernetes) before deploying to production. Test in a staging environment to confirm no federation or client compatibility regressions. Coordinate updates during maintenance windows to minimize disruption to active users.

Detection guidance

Monitor Synapse process CPU utilization in real-time; spikes sustained by a single authenticated session are suspicious. Enable debug logging of request handling to correlate high CPU periods with specific users or endpoint patterns. Track request queue depth and response latency—a spike in queued requests without corresponding traffic growth suggests resource starvation. Network intrusion detection can flag repeated requests from a single user to computationally expensive endpoints.

Why prioritize this

Although CVSS is Medium (5.5), organizations with public or multi-tenant Synapse instances should prioritize this patch because the attack surface includes all authenticated users and the impact is immediate and visible to other users. Insider-threat risk is elevated in shared environments. Conversely, isolated, single-user, or tightly-controlled instances face lower risk but should still apply the patch as part of routine maintenance.

Risk score, explained

CVSS 5.5 reflects medium severity: the attack requires local/authenticated access (low privilege), is not network-remote, and impacts availability only (no confidentiality or integrity compromise). The score is not low because the availability impact is high—the service becomes unresponsive—but it is not critical because the attack is confined to local authenticated users and does not enable code execution or data breach.

Frequently asked questions