Impact Synapse will produce an invalid "MSC4186 Sliding Sync" (https://github.com/matrix-org/matrix-spec-proposals/pull/4186) response in some conditions when a joined room contains an invalid name or avatar, or users with invalid profile data. This invalid response causes some clients, including Element X, to fail processing the sliding sync response and fail to make forward progress. The application then becomes unusable for the end-user. Homeservers that only have trusted local users and either do not federate or only participate in a closed, trusted federation are not affected. ### Patches Update to Synapse 1.157.2 or later. See the table below for patched versions of "Element Server Suite" (https://element.io/en/server-suite), including Long-Term Support (LTS) versions. | | 25.10 LTS | 26.4 LTS | Latest | |:--|--|--|--| | ESS Pro | "25.10.14+lts" | "26.4.9+lts" | "26.7.2" | | ESS Classic | "25.10.09-gui" | "26.04.04-gui" | ⸻ | | ESS Community | ⸻ | ⸻ | "26.7.2" | | ESS TI-Messenger | "25.10.10" | "26.4.5" | "26.7.0" | ### Workarounds No practical workarounds known. ### Identifiers - ELEMENTSEC-2026-1751 ### For more information If you have any questions or comments about this advisory, please email us at "security at element.io" (mailto:security@element.io).