CVE-2021-21274

    Dashboard / Vulnerabilities / CVE-2021-21274

    CVE-2021-21274

    Published: 26 Feb 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.

    References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/, https://github.com/matrix-org/synapse/releases/tag/v1.25.0, https://github.com/matrix-org/synapse/commit/ff5c4da1289cb5e097902b3e55b771be342c29d6, https://github.com/matrix-org/synapse/pull/8950, https://github.com/matrix-org/synapse/security/advisories/GHSA-2hwx-mjrm-v3g8

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 3bd9daf4b86ed811c9ced95a4adb9aa58b681399
    Fixed -ebd534b58d9d53dc5086a9dd9cb176868c7b93ef

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-21274 | CVE-DB