CVE-2021-21274

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.

• CWE-400
• CWE-770

• https://github.com/matrix-org/synapse/commit/ff5c4da1289cb5e097902b3e55b771be342c29d6Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/pull/8950Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.25.0Third Party Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-2hwx-mjrm-v3g8Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/
• https://github.com/matrix-org/synapse/commit/ff5c4da1289cb5e097902b3e55b771be342c29d6Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/pull/8950Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.25.0Third Party Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-2hwx-mjrm-v3g8Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/

Published

Feb 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21269Keymaker is a Mastodon Community Finder based Matrix Communi…6.5
• CVE-2021-2127Vulnerability in the Oracle VM VirtualBox product of Oracle …4.4
• CVE-2021-21270OctopusDSC is a PowerShell module with DSC resources that ca…5.5
• CVE-2021-21271Tendermint Core is an open source Byzantine Fault Tolerant (…6.5
• CVE-2021-21272ORAS is open source software which enables a way to push OCI…7.7
• CVE-2021-21273Synapse is a Matrix reference homeserver written in python (…6.1
• CVE-2021-21275The MediaWiki "Report" extension has a Cross-Site Request Fo…4.3
• CVE-2021-21276Polr is an open source URL shortener. in Polr before version…9.3
• CVE-2021-21277angular-expressions is "angular's nicest part extracted as a…8.8
• CVE-2021-21278RSSHub is an open source, easy to use, and extensible RSS fe…9.8
• CVE-2021-21279Contiki-NG is an open-source, cross-platform operating syste…7.5
• CVE-2021-2128Vulnerability in the Oracle VM VirtualBox product of Oracle …6.5