---
id: CVE-2021-21404
aliases:
  - GHSA-x462-89pf-6r5h
  - BIT-syncthing-2021-21404
  - GO-2022-0888
title: Crash due to malformed relay protocol message
summary: Crash due to malformed relay protocol message
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: syncthing
product: github.com/syncthing/syncthing
ecosystem: go
affected:
  - github.com/syncthing/syncthing < 1.15.0
patched:
  - github.com/syncthing/syncthing 1.15.0
published: '2021-05-21'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-x462-89pf-6r5h'
references:
  - url: >-
      https://github.com/syncthing/syncthing/security/advisories/GHSA-x462-89pf-6r5h
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-21404'
  - url: >-
      https://github.com/syncthing/syncthing/commit/fb4fdaf4c0a79c22cad000c42ac1394e3ccb6a97
  - url: 'https://github.com/syncthing/syncthing/releases/tag/v1.15.0'
  - url: 'https://pkg.go.dev/github.com/syncthing/syncthing'
tags:
  - osv
  - go
epss: 0.0197
epssPercentile: 0.79564
ingestedAt: '2026-07-09T18:56:36.974Z'
---

## Overview

### Impact

1. `syncthing` can be caused to crash and exit if sent a malformed relay
   protocol message message with a negative length field.

2. The relay server `strelaysrv` can be caused to crash and exit if sent
   a malformed relay protocol message with a negative length field.

At no point is sensitive data exposed or liable to be altered due to this
issue. Sensitive data is never exposed to relay operators. Syncthing itself
would need to be lured to connect to a malicious relay server in order to
exploit the issue.

### Patches

Fixed in version 1.15.0.

### Workarounds

1. No known workaround for `strelaysrv`.

2. `syncthing` can be configured to not use relays, or to only use specific,
   trusted relays. If Syncthing is used in a closed environment or with
   relaying disabled, i.e., it does not communicate with unknown relays,
   Syncthing is not vulnerable.

### For more information

If you have any questions or comments about this advisory, please discuss it [on the forum](https://forum.syncthing.net/).

Thanks to Wojciech Paciorek for discovering and reporting this issue.

## Affected packages

- `github.com/syncthing/syncthing < 1.15.0`

## Remediation

Upgrade to a patched release:

- `github.com/syncthing/syncthing 1.15.0`