CVE-2021-21274: Denial of Service Attack in matrix-synapse via .well-known lookups
Summary
CVE-2021-21274: Denial of service attack via .well-known lookups. Affects matrix-synapse versions >= 0.99.0, < 1.25.0. Fixed in 1.25.0. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2021-21274 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-synapse is an open-source server implementation of the Matrix protocol, which enables secure and decentralized communication. It allows users to exchange messages, create chat rooms, and share files. The vulnerability identified as CVE-2021-21274 affects matrix-synapse versions 0.99.0 to 1.24.0. This vulnerability allows a malicious homeserver to redirect requests to their .well-known file to a large file, leading to a denial of service attack. Any server that accepts federation requests from untrusted servers is susceptible to this vulnerability.
Vulnerability Detail
The vulnerability in matrix-synapse allows a malicious homeserver to exploit the .well-known file lookup functionality. By redirecting requests to a large file, the attacker can consume significant server resources, resulting in a denial of service attack. This can impact the availability and performance of homeservers communicating with the malicious homeserver. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.25.0
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.25.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround can be implemented by using the federation_domain_whitelist setting. This setting allows restricting communication with only trusted homeservers over federation. By configuring this whitelist, the risk of interacting with malicious homeservers and being affected by the vulnerability can be mitigated. The following example demonstrates how to use the federation_domain_whitelist setting:
[federation]
federation_domain_whitelist = example.com, trustedserver.org
Conclusion
The vulnerability in matrix-synapse allows a malicious homeserver to exploit the .well-known file lookup functionality, leading to a denial of service attack. It is crucial to upgrade to matrix-synapse version 1.25.0 or later to mitigate this vulnerability. Alternatively, implementing the federation_domain_whitelist setting can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
matrix-synapse is an open-source server implementation of the Matrix protocol, enabling secure and decentralized communication.
Versions 0.99.0 to 1.24.0 of matrix-synapse are affected by this vulnerability.
The vulnerability allows a malicious homeserver to conduct a denial of service attack, consuming significant server resources and impacting the availability and performance of other homeservers.
To fix this vulnerability, it is recommended to upgrade matrix-synapse to version 1.25.0 or later.
Yes, a workaround is available by using the federation_domain_whitelist setting to restrict communication with trusted homeservers over federation.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
