CVE-2021-21393
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Record
CVE-2021-21393- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2021-0129
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Record
EUVD-2021-0129- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jrh7-mhhx-6h88
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
Impact
Missing input validation of some parameters on the groups (also known as communities) endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields.
Patches
This issue is fixed by #9321 and #9393.
Workarounds
The groups feature can be disabled (by setting enable_group_creation to False) to mitigate this issue. Note that it is disabled by default.
Other information
Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them.
- Record
GHSA-jrh7-mhhx-6h88- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Record
CVE-2021-21393- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Record
CVE-2021-21393- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-21393
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Record
DEBIAN-CVE-2021-21393- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-jrh7-mhhx-6h88
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
Impact
Missing input validation of some parameters on the groups (also known as communities) endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields.
Patches
This issue is fixed by #9321 and #9393.
Workarounds
The groups feature can be disabled (by setting enable_group_creation to False) to mitigate this issue. Note that it is disabled by default.
Other information
Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them.
- Record
GHSA-jrh7-mhhx-6h88- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-21393
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Record
UBUNTU-CVE-2021-21393- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVPYSEC-2021-26 No score
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
- Record
PYSEC-2021-26- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-synapsePyPI |
before 1.28.0 | 1.28.0 |
matrix-synapsePyPI |
before 1.28.0, plus listed versions 0.33.50.33.5.10.33.60.33.6rc10.33.7 Show 45 moreShow less0.33.7rc10.33.7rc20.33.80.33.8rc20.33.90.34.00.34.0.10.34.0rc10.34.0rc20.34.1.10.99.00.99.0rc10.99.0rc20.99.0rc30.99.0rc40.99.10.99.1.10.99.1rc10.99.1rc20.99.20.99.2rc10.99.30.99.3.10.99.3.20.99.3rc10.99.40.99.4rc10.99.50.99.5.10.99.5.20.99.5rc11.0.01.0.0rc11.0.0rc21.0.0rc31.1.01.1.0rc11.1.0rc21.10.01.10.0rc11.10.0rc21.10.0rc31.10.0rc51.10.11.11.0 |
1.28.0 |
matrix-synapsePyPI |
before 1.28.0, plus listed versions 0.33.50.33.5.10.33.6rc10.33.60.33.7rc1 Show 45 moreShow less0.33.7rc20.33.70.33.8rc20.33.80.33.90.34.0rc10.34.0rc20.34.00.34.0.10.34.1.10.99.0rc10.99.0rc20.99.0rc30.99.0rc40.99.00.99.1rc10.99.1rc20.99.10.99.1.10.99.2rc10.99.20.99.3rc10.99.30.99.3.10.99.3.20.99.4rc10.99.40.99.5rc10.99.50.99.5.10.99.5.21.0.0rc11.0.0rc21.0.0rc31.0.01.1.0rc11.1.0rc21.1.01.2.0rc11.2.0rc21.2.01.2.11.3.0rc11.3.01.3.1 |
1.28.0 |
matrix-synapseUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.3.0-11.4.0-11.5.0-11.5.1-11.6.0-1 Show 12 moreShow less1.6.1-11.7.0-21.7.1-11.7.2-11.7.3-11.8.0-11.9.0-11.9.1-11.10.0-11.10.0-21.11.0-11.11.0-1ubuntu0.1~esm2 |
None known |
matrix-synapseUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.39.0-11.47.0-21.47.1-11.48.0-11.49.0-1 Show 7 moreShow less1.49.2-11.50.1-11.50.2-11.51.0-11.52.0-11.53.0-11.53.0-1ubuntu0.1~esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21393 is a medium vulnerability (CVSS 5.3) in Element-hq Synapse, published April 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in matrix-synapse 1.28.0.
References
pypi.org/project/matrix-synapse
github.com/matrix-org/synapse/pull/9321
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY
nvd.nist.gov/vuln/detail/CVE-2021-21393
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2021-21393
ubuntu.com/security/CVE-2021-21393
cve.org/CVERecord?id=CVE-2021-21393
Left out here: 202 versions. The JSON record has them.