---
id: CVE-2021-21394
aliases:
  - GHSA-w9fg-xffh-p362
  - PYSEC-2021-27
title: >-
  Denial of service (via resource exhaustion) due to improper input validation
  on third-party identifier endpoints
summary: >-
  Denial of service (via resource exhaustion) due to improper input validation
  on third-party identifier endpoints
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: matrix-synapse
product: matrix-synapse
ecosystem: pip
affected:
  - matrix-synapse < 1.28.0
patched:
  - matrix-synapse 1.28.0
published: '2021-04-13'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-w9fg-xffh-p362'
references:
  - url: >-
      https://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-21394'
  - url: 'https://github.com/matrix-org/synapse/pull/9321'
  - url: 'https://github.com/matrix-org/synapse/pull/9393'
  - url: 'https://github.com/matrix-org/synapse'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-27.yaml
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY
  - url: 'https://pypi.org/project/matrix-synapse'
tags:
  - osv
  - pip
epss: 0.01538
epssPercentile: 0.73809
ingestedAt: '2026-07-08T18:25:53.589Z'
---

## Overview

### Impact
Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.

### Patches
The issue is fixed by #9321.

### Workarounds
Depending on the needs and configuration of the homeserver a few options are available:

1. Using email as third-party identifiers be disabled by not configuring the `email` setting.
2. Using phone numbers as third-party identifiers can be disabled by ensuring that `account_threepid_delegates.msisdn` is not configured.
3. Additionally, the affected endpoint patterns can be blocked at a reverse proxy:

    * `^/_matrix/client/(r0|unstable)/register/email`
    * `^/_matrix/client/(r0|unstable)/register/msisdn`
    * `^/_matrix/client/(r0|unstable)/account/password`
    * `^/_matrix/client/(r0|unstable)/account/3pid`

## Affected packages

- `matrix-synapse < 1.28.0`

## Remediation

Upgrade to a patched release:

- `matrix-synapse 1.28.0`