GHSA-6qf2-7x63-mm6v
Synapse pagination Denial of Service
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | matrix-synapse | < 1.152.1 | 1.152.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
In federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients.
Clients could therefore fail to display room history.
### Patches
Update to Synapse 1.152.1 or later.
### Workarounds
There are no known workarounds for this issue.
### Identifiers
- ELEMENTSEC-2025-1636
### For more information
If you have any questions or comments about this advisory, please email us at [security at element.io](mailto:[email protected]).
References
External links from the advisory. They lead to third-party sites.