{"id":"CVE-2021-29471","aliases":["GHSA-x345-32rc-8h85","PYSEC-2021-135"],"title":"Denial of service attack via push rule patterns in matrix-synapse","summary":"Denial of service attack via push rule patterns in matrix-synapse","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","vendor":"matrix-synapse","product":"matrix-synapse","ecosystem":"pip","affected":["matrix-synapse < 1.33.2"],"patched":["matrix-synapse 1.33.2"],"published":"2021-05-13","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-x345-32rc-8h85","references":[{"url":"https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h85"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29471"},{"url":"https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977d226c"},{"url":"https://github.com/matrix-org/synapse"},{"url":"https://github.com/matrix-org/synapse/releases/tag/v1.33.2"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-135.yaml"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY"}],"tags":["osv","pip"],"epss":0.01647,"epssPercentile":0.75448,"ingestedAt":"2026-07-08T18:25:54.062Z","slug":"CVE-2021-29471","body":"## Overview\n\n### Impact\n\n\"Push rules\" can specify [conditions](https://matrix.org/docs/spec/client_server/r0.6.1#conditions) under which they will match, including `event_match`, which matches event content against a pattern including wildcards.\n\nCertain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events.\n\n### Patches\n\nThe issue is patched by https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977d226c.\n\n### Workarounds\n\nA potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at security@matrix.org.\n\n## Affected packages\n\n- `matrix-synapse < 1.33.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-synapse 1.33.2`","depth":"sunlit","depthScore":21,"depthScoreParts":{"impact":20.4,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}