Asymmetric Resource Consumption (Amplification) Affecting matrix-synapse package, versions [,1.152.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-MATRIXSYNAPSE-16726260
- published17 May 2026
- disclosed14 May 2026
- creditUnknown
Introduced: 14 May 2026
NewCVE-2026-45078 (opens in a new tab)How to fix?
Upgrade matrix-synapse to version 1.152.1 or higher.
Overview
matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.
Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) through the handling of authenticated user requests. An attacker can exhaust CPU resources and cause service disruption for other users by sending a high volume of requests. This is only exploitable if the server does not restrict the rate of requests from authenticated local users.
Workaround
This vulnerability can be mitigated by configuring a reverse proxy to limit the rate of user requests.