Synapse, an open source Matrix homeserver implementation, permits local authenticated users on versions prior to 1.152.1 to starve other requests of CPU, causing those requests to fail and denying service to other users. This weakness aligns with CWE-770, reflecting an excessive resource consumption flaw that can lead to service disruption.

The open source Matrix homeserver Synapse provided by Element HQ is affected. All installations using Synapse versions earlier than 1.152.1 are vulnerable, regardless of deployment size or configuration.

The vulnerability carries a CVSS score of 6.8, indicating moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The attack requires local authentication, which means an adversary who obtains credentials or exploits a trusted user context can trigger the denial of service. Once triggered, the CPU starvation can overwhelm the server’s ability to process legitimate requests, effectively denying service to other users.