Detections
Analytics
Alpine: synapse: security update to 1.152.1-r0
medium Tenable Cloud Security Plugin ID 442235
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms,
malicious homeservers can craft room events in such a way that prevents Synapse from providing full
history to paginating clients. Clients could therefore fail to display room history. This vulnerability is
fixed in 1.152.1. (CVE-2026-45076)
- Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users
can cause Synapse to starve other requests of CPU and lead to other requests failing, causing other users
to be denied service. This vulnerability is fixed in 1.152.1. (CVE-2026-45078)
Solution
Update the synapse library and its related packages to version 1.152.1-r0 or later.See Also
Plugin Details
Severity: Medium
ID: 442235
Version: Revision 1.6
Type: Local
Published: 5/20/2026
Updated: 6/24/2026
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C
CVSS Score Source: CVE-2026-45078
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6.8
Threat Score: 4.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 5/14/2026
Reference Information
CVE: CVE-2026-45076, CVE-2026-45078