6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45078

CVE-2026-45078: Synapse CPU starvation (Denial of Service)

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and lead to other requests failing, causing other users to be denied service. This vulnerability is fixed in 1.152.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45078

CVE-2026-45078:

6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
matrix-synapse	pip	< 1.152.1	1.152.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in an uncontrolled resource consumption issue within Synapse's worker lock handling, leading to a denial of service. When a worker process attempts to acquire a lock that is already held, it enters a waiting state with an exponential backoff retry mechanism. The flaw was that this backoff interval was not capped.

The analysis of the patch commit 3f58bc50dfba5768ee43ce48c5e74c25ba0b078a reveals that the methods WaitingLock._get_next_retry_interval and WaitingMultiLock._get_next_retry_interval implemented this flawed logic (self._retry_interval = max(5, next * 2)), causing the wait time to grow exponentially without limit. This could cause the timeout to become so large that the worker process would effectively freeze, unable to process any further requests, thus denying service to other users. The commit message's reference to a ValueError for integer string conversion confirms that the timeout value could grow to an astronomical size.

The vulnerable functions are WaitingLock.__aenter__ and WaitingMultiLock.__aenter__ in synapse/handlers/worker_lock.py, as they orchestrate the lock acquisition and the vulnerable waiting loop. An attacker could trigger this by causing persistent lock contention, forcing workers into this state of indefinite waiting.

The patch remediates this by replacing the unbounded backoff with a capped one. The new _increment_timeout_interval method ensures the timeout does not exceed 60 seconds, preventing the worker from becoming permanently stuck.

Vulnerable functions

WaitingLock.__aenter__

synapse/handlers/worker_lock.py

The `__aenter__` method of the `WaitingLock` class is used to acquire a lock. When the lock is contended, it enters a waiting loop. In this loop, it used to calculate the next timeout with an unbounded exponential backoff. This could lead to an extremely large timeout value, causing the worker process to hang for a very long time, leading to a denial of service. The patch fixes this by capping the timeout to 60 seconds.

WaitingMultiLock.__aenter__

synapse/handlers/worker_lock.py

The `__aenter__` method of the `WaitingMultiLock` class is used to acquire multiple locks. When locks are contended, it enters a waiting loop. In this loop, it used to calculate the next timeout with an unbounded exponential backoff. This could lead to an extremely large timeout value, causing the worker process to hang for a very long time, leading to a denial of service. The patch fixes this by capping the timeout to 60 seconds.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.