MEDIUM5.5

PYSEC-2026-191

Quick fix

PYSEC-2026-191 — matrix-synapse: upgrade to the fixed version with the command below.

pip install --upgrade 'matrix-synapse>=1.152.1'

Details

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and lead to other requests failing, causing other users to be denied service. This vulnerability is fixed in 1.152.1.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/matrix-synapse

Introduced in: 0Fixed in: 1.152.1

Fixpip install --upgrade 'matrix-synapse>=1.152.1'

References

https://github.com/element-hq/synapse/security/advisories/GHSA-8q93-326v-3m7g[ADVISORY]