A malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver.
This affects any server which accepts federation requests from untrusted servers.
Issue is resolved by #8950. A bug not affecting the security aspects of this was fixed in #9108.
The federation_domain_whitelist
setting can be used to restrict the homeservers communicated with over federation.
{ "nvd_published_at": "2021-02-26T18:15:00Z", "cwe_ids": [ "CWE-400", "CWE-770" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2021-03-01T19:03:06Z" }