Matrix Synapse CVE-2026-45076

Synapse is the reference implementation of the Matrix protocol, an open standard for decentralized, interoperable real-time communication. The vulnerability exploits improper validation of room events (CWE-20: Improper Input Validation) in the context of federated architecture, where homeservers communicate across trust boundaries to maintain shared room state. When clients request room history pagination via the Matrix client-server API, Synapse aggregates events from its database and federated sources. Malicious homeservers can craft events with specific properties that cause Synapse's pagination logic to fail, preventing it from returning the complete history slice requested by the client. This is not a traditional denial-of-service against availability, but rather a targeted information disclosure where legitimate historical messages become inaccessible through normal pagination flow.