CVE-2026-102595

Impact For some HTTP request paths, Synapse will ignore extraneous path segments and therefore serve a resource at an unexpected path. This could allow evasion of external rate-limiting that may be in place. The Client-Server API "/matrix/client", Federation API "/matrix/federation", Synapse Admi...