Impact Synapse's mitigation for malicious "multipart/form-data" requests (see https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2) can be bypassed by varying the case of the "Content-Type" header. When processing such a maliciously-crafted request, Synapse quickly exhausts all available memory, becoming unresponsive and/or being terminated, denying service to other users. ### Patches Update to Synapse 1.157.2 or later, which corrects the mitigation to deny such requests. See the table below for patched versions of "Element Server Suite" (https://element.io/en/server-suite), including Long-Term Support (LTS) versions. | | 25.10 LTS | 26.4 LTS | Latest | |:--|--|--|--| | ESS Pro | "25.10.14+lts" | "26.4.9+lts" | "26.7.2" | | ESS Classic | "25.10.09-gui" | "26.04.04-gui" | ⸻ | | ESS Community | ⸻ | ⸻ | "26.7.2" | | ESS TI-Messenger | "25.10.10" | "26.4.5" | "26.7.0" | ### Workarounds Limiting request sizes or blocking the "multipart/form-data" content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low "max_upload_size" in Synapse. ### Identifiers - ELEMENTSEC-2026-1740 ### For more information If you have any questions or comments about this advisory, please email us at "security at element.io" (mailto:security@element.io).