PyPI/matrix-synapse CVE-2021-21394: medium 5.3, EPSS 1.54%

Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints

Action: Upgrade matrix-synapse to 1.28.0 or later.

pip install matrix-synapse==1.28.0

Affected

Fixed versions

Sources

• osv: GHSA-w9fg-xffh-p362
• https://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362
• https://nvd.nist.gov/vuln/detail/CVE-2021-21394
• https://github.com/matrix-org/synapse/pull/9321
• https://github.com/matrix-org/synapse/pull/9393
• https://github.com/matrix-org/synapse
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-27.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY
• https://pypi.org/project/matrix-synapse

CVE-2021-21394 · published 2021-04-13T15:12:51Z · modified 2026-07-08T06:30:03.309970611Z · JSON