Описание
Synapse pagination Denial of Service
Impact
In federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients.
Clients could therefore fail to display room history.
Patches
Update to Synapse 1.152.1 or later.
Workarounds
There are no known workarounds for this issue.
Identifiers
- ELEMENTSEC-2025-1636
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Пакеты
matrix-synapse
< 1.152.1
1.152.1
Связанные уязвимости
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
Synapse is an open source Matrix homeserver implementation. Prior to 1 ...
ALT-PU-2026-18273: package `matrix-synapse` update to version 1.162.0-alt1