Resource Exhaustion Vulnerability in Matrix Synapse (CVE-2021-21393)
Summary
CVE-2021-21393: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Affects matrix-synapse across 2 version ranges.
< 1.28.0-1
< 2756517f7a6e17d2403de44981569dc18329315b
Fixed in 1.28.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix Synapse is a reference homeserver for the Matrix protocol, which facilitates open federated instant messaging and VoIP services. Written in Python, it allows users to communicate across different platforms while maintaining privacy and security. The package is widely used for its scalability and flexibility, but it has a vulnerability that can lead to resource exhaustion due to improper input validation.
Vulnerability Detail
The vulnerability identified as CVE-2021-21393 exists in Matrix Synapse versions prior to 1.28.0. It arises from the lack of input validation on certain parameters in endpoints that confirm third-party identifiers. This oversight can lead to excessive consumption of disk space and memory, potentially causing the server to become unresponsive or crash. The issue is exacerbated by the arbitrary maximum lengths set for these identifiers, which may not be respected by all clients, leading to unpredictable behavior.
How To Fix
Minimum fixed version
1.28.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade matrix-synapseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input size for third-party identifiers by configuring your server settings to enforce stricter validation rules. However, this is not a permanent solution and upgrading is strongly recommended.
Conclusion
CVE-2021-21393 is a significant vulnerability in Matrix Synapse that can lead to resource exhaustion. It is crucial for users to upgrade to version 1.28.0 or later to mitigate this risk. Temporary workarounds can be implemented, but they are not substitutes for a proper upgrade.
See every vulnerability recorded for matrix-synapse →
FAQ
CVE-2021-21393 is a vulnerability in Matrix Synapse that allows for resource exhaustion due to improper input validation.
If exploited, this vulnerability can lead to excessive disk space and memory usage, potentially causing the server to crash or become unresponsive.
You can use Vulert's playground to check if your application is affected by this vulnerability without any signup required.
The CVSS score for CVE-2021-21393 is 6.5, indicating a moderate level of severity.
As a temporary measure, you can implement stricter input validation rules in your server settings to limit the size of third-party identifiers.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
