CVE-2021-29471

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.33.2

Description The issue is related to uncontrolled resource consumption in Synapse's push rules. It allows a remote attacker to cause a denial-of-service. The problem arises when certain patterns, including wildcards, are used in the event match condition, leading to poor performance in the matching engine when processing moderate length events.

Recommendations For versions prior to 1.33.2, update to version 1.33.2 to resolve the issue. As a temporary workaround, consider preventing users from making custom push rules by blocking such requests at a reverse-proxy.