Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-synapse | pip | < 1.152.1 | 1.152.1 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the get_messages function in synapse/handlers/pagination.py. The function is responsible for handling pagination of room messages. The flaw was in the logic that determined the end of the message stream. Before the patch, the code checked if the events list was empty to decide whether to stop pagination. However, it didn't account for the case where a page might be full of rejected events, resulting in an empty events list even though more events existed on subsequent pages. A malicious homeserver could exploit this by sending a series of rejected events to fill up a pagination page, causing Synapse to prematurely stop sending history to clients, leading to a denial of service. The patch addresses this by introducing a limited flag from the paginate_room_events_by_topological_ordering function. The get_messages function now checks if not limited and not events: to determine the end of the stream, ensuring that pagination continues as long as there are more pages to fetch, regardless of whether the current page contains visible events.
