VDB
Sign up
LOW2.7

PYSEC-2026-194

Quick fix

PYSEC-2026-194 — matrix-synapse: upgrade to the fixed version with the command below.

pip install --upgrade 'matrix-synapse>=1.152.1'

Details

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/matrix-synapse
Introduced in: 0Fixed in: 1.152.1
Fixpip install --upgrade 'matrix-synapse>=1.152.1'

References