Denial of service attack via memory exhaustion
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service. This affects any server which accepts registration requests from untrusted clients. This issue has been patched by releases 89071a1, 0523511, f56eee3. As a workaround request sizes can be limited in an HTTP reverse-proxy. There are no known workarounds for the problem with overlarge responses.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | sydent | before 2.3.0 | 2.3.0 | Patch available | CNA |
| — | matrix-sydent (PyPI) | before 2.3.0 | 2.3.0 | Patch available | GHSA-wmg4-8cp2-hpg9 |
- sydent Vendormatrix-org Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA
- matrix-sydent (PyPI) Vendor— Affected before 2.3.0 Fixed in 2.3.0 Patch available GHSA-wmg4-8cp2-hpg9
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:* | before 2.3.0 | Vulnerable | matrix-org |
- cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:* Versions before 2.3.0 Vulnerable ·matrix-org
Remediation
- Fix · CNA sydent (matrix-org) Fixed in 2.3.0
- Fix · GHSA-wmg4-8cp2-hpg9 matrix-sydent (PyPI) Fixed in 2.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29430
- 2026-10-03 Alias added: GHSA-wmg4-8cp2-hpg9
References
Patch 4
- https://github.com/matrix-org/sydent/security/advisories/GHSA-wmg4-8cp2-hpg9
- https://github.com/matrix-org/sydent/commit/89071a1a754c69a50deac89e6bb74002d4cda19d
- https://github.com/matrix-org/sydent/commit/0523511d2fb40f2738f8a8549868f44b96e5dab7
- https://github.com/matrix-org/sydent/commit/f56eee315b6c44fdd9f6aa785cc2ec744a594428
Advisory 3
More matrix-org Sydent vulnerabilities
- TI-2023-20035 Sydent does not verify email server certificates CVSS 3.1CRITICAL 9.3
- TI-2021-10144 SSRF in Sydent due to missing validation of hostnames CVSS 3.1HIGH 7.7
- TI-2019-08878 An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. CVSS 3.0HIGH 7.5
- TI-2019-08469 util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions… CVSS 3.0MEDIUM 5.9
- TI-2021-10145 Malicious users could control the content of invitation emails CVSS 3.1MEDIUM 5.7
- TI-2021-10146 Denial of service (via resource exhaustion) due to improper input validation CVSS 3.1MEDIUM 4.3
Sources
- CVE-2021-29430 · CVE Program
- CVE-2021-29430 · NVD
- FIRST EPSS
- GHSA-wmg4-8cp2-hpg9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences