PyPI/matrix-synapse CVE-2021-21392: medium 6.3, EPSS 0.94%

Open redirect via transitional IPv6 addresses on dual-stack networks

Action: Upgrade matrix-synapse to 1.28.0rc1 or later.

pip install matrix-synapse==1.28.0rc1

Affected

Fixed versions

Sources

• osv: GHSA-5wrh-4jwv-5w78
• https://github.com/matrix-org/synapse/security/advisories/GHSA-5wrh-4jwv-5w78
• https://nvd.nist.gov/vuln/detail/CVE-2021-21392
• https://github.com/matrix-org/synapse/pull/9240
• https://github.com/matrix-org/synapse/commit/4ca054a4eaa714d0befb4fc30b19a1131e52c9cc
• https://github.com/matrix-org/synapse
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-25.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY
• https://pypi.org/project/matrix-synapse

CVE-2021-21392 · published 2021-04-13T15:13:08Z · modified 2026-07-08T06:28:51.474360522Z · JSON