CVE-2021-29430

### Impact Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to disk space exhaustion and denial of service. Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service. This affects any server which accepts registration requests from untrusted clients. ### Patches Patched by 89071a1, 0523511, f56eee3. ### Workarounds Request sizes can be limited in an HTTP reverse-proxy. There are no known workarounds for the problem with overlarge responses. ### For more information If you have any questions or comments about this advisory, email us at [email protected].