GHSA-6QF2-7X63-MM6V中危已审查

Synapse pagination Denial of Service

OSV 1.4.0 · github-reviewed · 修改于 2026-06-09 18:18

发布时间

2026-05-15 00:18

GitHub 审查时间

2026-05-15 00:18

NVD 发布时间

2026-05-29 01:16

源文件

advisories/github-reviewed/2026/05/GHSA-6qf2-7x63-mm6v/GHSA-6qf2-7x63-mm6v.json

公告说明

Impact

In federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients.

Clients could therefore fail to display room history.

Patches

Update to Synapse 1.152.1 or later.

Workarounds

There are no known workarounds for this issue.

Identifiers

ELEMENTSEC-2025-1636

For more information

If you have any questions or comments about this advisory, please email us at security at element.io.

受影响的软件包

PyPI

matrix-synapse

ECOSYSTEM

标识信息

别名 / CVE

CVE-2026-45076

CWE

CWE-20

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-6qf2-7x63-mm6v",
  "aliases": [
    "CVE-2026-45076"
  ],
  "details": "### Impact\n\nIn federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients.\n\nClients could therefore fail to display room history.\n\n### Patches\n\nUpdate to Synapse 1.152.1 or later.\n\n### Workarounds\n\nThere are no known workarounds for this issue.\n\n### Identifiers\n\n- ELEMENTSEC-2025-1636\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at element.io](mailto:[email protected]).",
  "summary": "Synapse pagination Denial of Service",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.152.1"
            }
          ]
        }
      ],
      "package": {
        "name": "matrix-synapse",
        "ecosystem": "PyPI"
      }
    }
  ],
  "modified": "2026-06-09T10:18:35Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-05-14T16:18:46Z",
  "references": [
    {
      "url": "https://github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45076",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/element-hq/synapse",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2026-194.yaml",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2026-05-28T17:16:31Z",
    "github_reviewed_at": "2026-05-14T16:18:46Z"
  }
}