CVE-2021-29471

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400 CWE-331

Affected software

No affected versions have been published.

Timeline

Published: May 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294728.8Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not CVE-2021-294732.5Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds CVE-2021-294745.8HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker can read arbitrary `.md` files from the ser CVE-2021-2947510.0HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the CVE-2021-294769.8Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of CVE-2021-294778.8Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow b CVE-2021-294788.8Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow b CVE-2021-294796.1Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to per CVE-2021-294803.1Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup CVE-2021-294817.5Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in CVE-2021-294827.5xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the CVE-2021-294837.5ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through th