{"id":"CVE-2026-45078","aliases":["GHSA-8q93-326v-3m7g","PYSEC-2026-191"],"title":"Synapse CPU starvation (Denial of Service)","summary":"Synapse CPU starvation (Denial of Service)","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","vendor":"matrix-synapse","product":"matrix-synapse","ecosystem":"pip","affected":["matrix-synapse < 1.152.1"],"patched":["matrix-synapse 1.152.1"],"published":"2026-05-14","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:04.962109818Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8q93-326v-3m7g","references":[{"url":"https://github.com/element-hq/synapse/security/advisories/GHSA-8q93-326v-3m7g"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45078"},{"url":"https://github.com/element-hq/synapse/issues/19394"},{"url":"https://github.com/element-hq/synapse/commit/3f58bc50dfba5768ee43ce48c5e74c25ba0b078a"},{"url":"https://github.com/element-hq/synapse"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2026-191.yaml"}],"tags":["osv","pip"],"epss":0.00128,"epssPercentile":0.02824,"ingestedAt":"2026-09-12T03:13:01.678Z","slug":"CVE-2026-45078","body":"## Overview\n\n### Impact\n\nLocal authenticated users can cause Synapse to starve other requests of CPU and lead to other requests failing, causing other users to be denied service.\n\nHomeservers that trust all their local users are not at risk.\n\n### Patches\n\nUpdate to Synapse 1.152.1 or later.\n\n### Workarounds\n\nIf Synapse is deployed behind a reverse proxy, the reverse proxy could be configured to limit the rate of user requests,\npreventing or increasing the difficulty of the attack.\n\n### Identifiers\n\n- ELEMENTSEC-2026-1706\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).\n\n## Affected packages\n\n- `matrix-synapse < 1.152.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-synapse 1.152.1`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}