CVE-2021-21274: fedoraproject fedora Uncontrolled Resource Consumption
Vulnerability summary
CVE-2021-21274 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in fedoraproject fedora. EPSS estimates a 2.16% chance of exploitation in the next 30 days, higher than 81.9% of scored vulnerabilities.
Timeline
- 26-02-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.
CVSS metrics
7 scores · 5 sources · 3 versions- CVE.orgCNA4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LDiffers
- OSV · PypiEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.16%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.16% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Debian1 product
- matrix-synapse< 1.25.0-1
Fedoraproject1 product
- fedoraEOL34
Matrix1 product
- synapse≥ 0.99.0, < 1.25.0
Matrix-org1 product
- synapse≥ 0.99.0, < 1.25.0
PyPI1 product
- matrix-synapse< ff5c4da1289cb5e097902b3e55b771be342c29d6 | ≥ 0.99.0, < 1.25.0
Ubuntu1 product
- matrix-synapseAll versions (No fix recorded)
6 vendors · 6 products
References
12 links- github.com/matrix-org/synapse/security/advisories/GHSA-2hwx-mjrm-v3g8X Refsource CONFIRMWEBAdvisoryREPORTPatchThird Party Advisory
- github.com/matrix-org/synapse/commit/ff5c4da1289cb5e097902b3e55b771be342c29d6X Refsource MISCWEBFIXREPORTPatchThird Party Advisory
