Listen to this Post
In federated Matrix rooms, a malicious homeserver can craft specially designed room events that cause a Synapse server to fail when processing pagination requests. When a client attempts to paginate through room history, the vulnerable Synapse instance attempts to process these malicious events. The improper handling of these events leads to a failure in retrieving the full history, resulting in an incomplete or blank timeline for clients. This vulnerability is triggered remotely by any federated server sharing a room with the target server, and it requires no user interaction. The flaw lies in how Synapse processes and orders events from remote servers during pagination. By sending a series of specifically formatted events, the malicious server can effectively block the Synapse server from responding with the correct historical data. This degrades the user experience and can be used to disrupt communication within affected rooms. The issue has been addressed in Synapse 1.152.1, which introduces validation to ensure that pagination tokens and event ordering are correctly maintained even when receiving maliciously crafted events. No workarounds are available; upgrading is the only mitigation. The vulnerability is considered moderate because it does not lead to remote code execution or data loss, but it can cause persistent denial of service for clients attempting to view room history.
dailycve form:
Platform: Matrix Synapse
Version: <1.152.1
Vulnerability: Pagination history block
Severity: Moderate
Date: 2026-05-14
Prediction: 2026-05-21
What Undercode Say:
Check current Synapse version
synapse_version=$(dpkg -l | grep matrix-synapse | awk '{print $3}')
echo "Current Synapse version: $synapse_version"
Verify if patch is applied
if [[ "$synapse_version" < "1.152.1" ]]; then
echo "Vulnerable to CVE-2026-XXXXX. Upgrade immediately."
else
echo "Patched against pagination DoS."
fi
Simulate pagination request to test for issue
curl -X GET "https://matrix.example.com/_matrix/client/v3/rooms/!roomid:server/messages?dir=b&limit=10" \
-H "Authorization: Bearer $ACCESS_TOKEN"
Exploit:
A malicious federated server sends a room event with intentionally malformed or out-of-order fields that disrupt pagination token generation. When a victim client requests historical messages, the vulnerable Synapse instance fails to construct a valid response, returning an empty or error state. Repeated exploitation can make room history permanently unavailable.
Protection from this CVE:
Upgrade to Synapse 1.152.1 or later. Block federation from untrusted servers as a temporary measure. Monitor pagination endpoints for unusual error patterns. Use a reverse proxy to limit request rates to pagination APIs.
Impact:
Clients cannot retrieve full room history, leading to broken timelines and loss of context in conversations. Persistent failure may require manual intervention to repair room state. This affects all federated rooms where a malicious server is present.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
