CVE-2021-29471: Denial-of-Service Vulnerability in matrix-synapse
Summary
CVE-2021-29471: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Affects matrix-synapse across 2 version ranges.
< 1.33.2
< 03318a766cac9f8b053db2214d9c332a977d226c
Fixed in 03318a766cac9f8b053db2214d9c332a977d226c. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2021-29471 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-synapse is a Python-based Matrix reference homeserver that enables open federated Instant Messaging and VoIP. It serves as an integral part of the Matrix ecosystem. The vulnerability affects versions prior to 1.33.2 of matrix-synapse. The package allows users to define "Push rules" that specify conditions for matching events, including event content matching against patterns with wildcards. However, certain patterns can cause severe performance issues in the matching engine, leading to a denial-of-service (DoS) vulnerability when processing moderate length events.
Vulnerability Detail
The vulnerability in matrix-synapse arises from the inefficient handling of event content matching against patterns with wildcards in "Push rules". This can result in a DoS situation when processing events of moderate length. An attacker can exploit this vulnerability by crafting events with specific patterns, causing the matching engine to consume excessive resources and leading to service disruption. The issue has been addressed in version 1.33.2 of matrix-synapse.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
03318a766cac9f8b053db2214d9c332a977d226c
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==03318a766cac9f8b053db2214d9c332a977d226c"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A potential workaround for this vulnerability is to prevent users from creating custom push rules. This can be achieved by blocking requests for creating custom push rules at a reverse-proxy level. By disallowing users from defining their own push rules, the risk of triggering the vulnerable code path can be mitigated.
Conclusion
The vulnerability in matrix-synapse (CVE-2021-29471) allows for a denial-of-service attack due to inefficient handling of event content matching against patterns with wildcards in "Push rules". Upgrading to version 1.33.2 or later of matrix-synapse is recommended to mitigate this vulnerability. Alternatively, blocking requests for creating custom push rules at a reverse-proxy level can serve as a workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
matrix-synapse is a Python-based Matrix reference homeserver that facilitates open federated Instant Messaging and VoIP.
The vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) situation in matrix-synapse, resulting in service disruption.
Versions prior to 1.33.2 of matrix-synapse are affected by this vulnerability.
To fix the vulnerability, update matrix-synapse to version 1.33.2 or later by following the official upgrade instructions.
Yes, a potential workaround is to block requests for creating custom push rules at a reverse-proxy level.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
