CVE-2021-29471CWE-400

Denial of service in Matrix Synapse

Low · published May 11, 2021

CVSS v3.1
3.7
EPSS
2%
Percentile
76.3
In the wild
Unconfirmed
What it is

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01647 · 76.3th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2021-05-11T15:05Z
EPSS history
Timeline
  • 11 MAY 15:05Z
    Denial of service in Matrix Synapse
    cvelistv5