Synapse, an open‑source Matrix homeserver from element‑hq, is vulnerable to an input validation flaw (CWE‑20) that allows a malicious federated homeserver to craft room events that prevent Synapse from delivering complete room history to clients attempting to paginate. The result is that clients may be unable to display the expected timeline, effectively causing a denial of service to end users who rely on the full history view.

All Synapse deployments from element‑hq running a version earlier than 1.152.1 are susceptible, regardless of geographic or host location. The vulnerability specifically affects federated rooms where external servers can inject crafted events.

The CVSS score of 5.1 indicates moderate severity; no EPSS score is published and the issue is not listed in the CISA KEV catalog. The likely attack vector is a malicious federated homeserver that injects crafted events; an attacker could repeatedly trigger pagination failures against targeted clients, causing progressive loss of service. The impact is limited to client display issues rather than compromising the server’s data integrity or confidentiality.