CVE-2021-29471: Denial of Service Attack in matrix-synapse
Summary
CVE-2021-29471: Denial of service attack via push rule patterns in matrix-synapse. Affects matrix-synapse versions < 1.33.2. Fixed in 1.33.2. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2021-29471 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-synapse is an open-source Python package available on PyPI. It is a reference implementation of the Matrix protocol, which provides a decentralized communication platform. matrix-synapse allows users to create custom push rules, which specify conditions for matching events. These rules can include event content patterns with wildcards. However, certain patterns can cause a denial-of-service attack by severely impacting the performance of the matching engine.
Vulnerability Detail
The vulnerability (CVE-2021-29471) in matrix-synapse allows an attacker to launch a denial-of-service attack by exploiting the push rule patterns. By crafting specific patterns, an attacker can cause the matching engine to perform poorly, leading to a denial-of-service condition. This vulnerability can be triggered by processing moderate length events. The impact of this vulnerability is a disruption of service availability.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.33.2
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.33.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A potential workaround for this vulnerability is to prevent users from creating custom push rules. This can be achieved by blocking requests for custom push rules at a reverse-proxy level.
Conclusion
The vulnerability in matrix-synapse (CVE-2021-29471) allows an attacker to launch a denial-of-service attack by exploiting push rule patterns. It has been fixed in version 1.33.2 of matrix-synapse. Users should update their installations to the latest version to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
matrix-synapse is an open-source Python package that implements the Matrix protocol, providing a decentralized communication platform.
The vulnerability allows an attacker to launch a denial-of-service attack, causing a disruption of service availability.
To fix the vulnerability, update matrix-synapse to version 1.33.2 using the command: pip install --upgrade matrix-synapse==1.33.2.
A potential workaround is to block requests for custom push rules at a reverse-proxy level.
For more information, you can refer to the advisory at security@matrix.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
