CVE-2021-21394: matrix-synapse - Resource Exhaustion Vulnerability
Summary
CVE-2021-21394: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Affects matrix-synapse versions < 1.28.0. Fixed in 1.28.0. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2021-21394 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-synapse is a Python package that serves as a Matrix reference homeserver. Matrix is an open federated Instant Messaging and VoIP ecosystem. The package is responsible for facilitating communication between Matrix clients and servers. It provides various features, including the ability to confirm third-party identifiers. However, prior to version 1.28.0, matrix-synapse lacks input validation for certain parameters in the endpoints used for confirming third-party identifiers. This vulnerability can lead to resource exhaustion, causing excessive use of disk space and memory. It is important to note that the groups feature is not part of the Matrix specification, and the chosen maximum lengths are arbitrary. It is possible that not all clients adhere to these limits.
Vulnerability Detail
The vulnerability in matrix-synapse allows an attacker to exploit the lack of input validation in the confirmation of third-party identifiers. By sending specially crafted parameters, an attacker can cause the server to consume excessive disk space and memory, leading to resource exhaustion. This can result in degraded server performance, denial of service, or even complete server failure. It is crucial to address this vulnerability to ensure the stability and availability of the Matrix server.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.28.0
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.28.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to update matrix-synapse to the fixed version.
Conclusion
The resource exhaustion vulnerability in matrix-synapse can be mitigated by updating the package to version 1.28.0 or later. This update includes input validation to prevent excessive resource consumption. It is important to address this vulnerability to ensure the stability and availability of the Matrix server. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
matrix-synapse is a Python package that serves as a Matrix reference homeserver. It enables communication between Matrix clients and servers in the Matrix ecosystem.
The vulnerability can result in resource exhaustion, causing excessive use of disk space and memory. This can lead to degraded server performance, denial of service, or server failure.
To mitigate this vulnerability, it is recommended to update matrix-synapse to version 1.28.0 or later, which includes the necessary input validation to prevent resource exhaustion.
The groups feature is not part of the Matrix specification, and the chosen maximum lengths are arbitrary. It is possible that not all clients adhere to these limits.
You can refer to the GitHub security advisory for additional details, including workarounds, if any.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
