CVE-2021-21274 - CVE House
Back to Database
Status published Medium CVE-2021-21274

Denial of service attack via .well-known lookups

Vulnerability Description

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21274

Credits & Attribution

No credits recorded in the NVD database.

References

More from matrix-org

View All →
CVE-2025-66622
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
Low 1.3
CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Low 2.7
CVE-2025-59047
matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
Low 2.7
CVE-2025-53549
Matrix Rust SDK allows SQL injection in the EventCache implementation
Medium 5.2
CVE-2025-48937
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
Medium 4.9

Affected Vendor

Affected Software

synapse
Vulnerable Versions:
>=0.99.0, < 1.25.0

Timeline

Official Publish: February 26th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact