{"id":"GHSA-w9fg-xffh-p362","summary":"Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints","details":"### Impact\nMissing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.\n\n### Patches\nThe issue is fixed by #9321.\n\n### Workarounds\nDepending on the needs and configuration of the homeserver a few options are available:\n\n1. Using email as third-party identifiers be disabled by not configuring the `email` setting.\n2. Using phone numbers as third-party identifiers can be disabled by ensuring that `account_threepid_delegates.msisdn` is not configured.\n3. Additionally, the affected endpoint patterns can be blocked at a reverse proxy:\n\n    * `^/_matrix/client/(r0|unstable)/register/email`\n    * `^/_matrix/client/(r0|unstable)/register/msisdn`\n    * `^/_matrix/client/(r0|unstable)/account/password`\n    * `^/_matrix/client/(r0|unstable)/account/3pid`","aliases":["CVE-2021-21394","PYSEC-2021-27"],"modified":"2026-07-08T06:30:03.309970611Z","published":"2021-04-13T15:12:51Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2021-04-12T21:01:40Z","nvd_published_at":"2021-04-12T21:15:00Z","cwe_ids":["CWE-20"]},"references":[{"type":"WEB","url":"https://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21394"},{"type":"WEB","url":"https://github.com/matrix-org/synapse/pull/9321"},{"type":"WEB","url":"https://github.com/matrix-org/synapse/pull/9393"},{"type":"PACKAGE","url":"https://github.com/matrix-org/synapse"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-27.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY"},{"type":"WEB","url":"https://pypi.org/project/matrix-synapse"}],"affected":[{"package":{"name":"matrix-synapse","ecosystem":"PyPI","purl":"pkg:pypi/matrix-synapse"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0"}]}],"versions":["0.33.5","0.33.5.1","0.33.6","0.33.6rc1","0.33.7","0.33.7rc1","0.33.7rc2","0.33.8","0.33.8rc2","0.33.9","0.34.0","0.34.0.1","0.34.0rc1","0.34.0rc2","0.34.1.1","0.99.0","0.99.0rc1","0.99.0rc2","0.99.0rc3","0.99.0rc4","0.99.1","0.99.1.1","0.99.1rc1","0.99.1rc2","0.99.2","0.99.2rc1","0.99.3","0.99.3.1","0.99.3.2","0.99.3rc1","0.99.4","0.99.4rc1","0.99.5","0.99.5.1","0.99.5.2","0.99.5rc1","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.1.0","1.1.0rc1","1.1.0rc2","1.10.0","1.10.0rc1","1.10.0rc2","1.10.0rc3","1.10.0rc5","1.10.1","1.11.0","1.11.0rc1","1.11.1","1.12.0","1.12.0rc1","1.12.1","1.12.1rc1","1.12.2","1.12.3","1.12.4","1.12.4rc1","1.13.0","1.13.0rc1","1.13.0rc2","1.13.0rc3","1.14.0","1.14.0rc1","1.14.0rc2","1.15.0","1.15.0rc1","1.15.1","1.15.2","1.16.0","1.16.0rc1","1.16.0rc2","1.16.1","1.17.0","1.17.0rc1","1.18.0","1.18.0rc1","1.18.0rc2","1.19.0","1.19.0rc1","1.19.1","1.19.1rc1","1.19.2","1.19.3","1.2.0","1.2.0rc1","1.2.0rc2","1.2.1","1.20.0","1.20.0rc1","1.20.0rc2","1.20.0rc3","1.20.0rc4","1.20.0rc5","1.20.1","1.21.0","1.21.0rc1","1.21.0rc2","1.21.0rc3","1.21.1","1.21.2","1.22.0","1.22.0rc1","1.22.0rc2","1.22.1","1.23.0","1.23.0rc1","1.23.1","1.24.0","1.24.0rc1","1.24.0rc2","1.25.0","1.25.0rc1","1.26.0","1.26.0rc1","1.26.0rc2","1.27.0","1.27.0rc1","1.27.0rc2","1.28.0rc1","1.3.0","1.3.0rc1","1.3.1","1.4.0","1.4.0rc1","1.4.0rc2","1.4.1","1.4.1rc1","1.5.0","1.5.0rc1","1.5.0rc2","1.5.1","1.6.0","1.6.0rc1","1.6.0rc2","1.6.1","1.7.0","1.7.0rc1","1.7.0rc2","1.7.1","1.7.2","1.7.3","1.8.0","1.8.0rc1","1.9.0","1.9.0.dev1","1.9.0.dev2","1.9.0rc1","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-w9fg-xffh-p362/GHSA-w9fg-xffh-p362.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}