CVE-2021-29433: PYSEC-2021-24 - ### Impact Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of

CVE-2021-29433 · Severity: low · CVSS 3.1 · Published 2021-04-15

Technologies: matrix-sydent (PyPI). Vendors: PyPI.

Executive brief

### Impact Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. ### Patches Fixed by 3175fd3. ### Workarounds There are no known workarounds. ### References n/a ### For more information If you have any questions or comments about this advisory, email us at security@matrix.org.

Affected products

PyPI matrix-sydent

Related threats

PYSEC-2026-2620 - matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG
PYSEC-2026-843 - Matrix Sydent mishandles emails
PYSEC-2023-139 - Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent
PYSEC-2021-22 - Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter
PYSEC-2021-23 - Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address