https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 17:17:33 +0000 https://cve.radiocsirt.org/vuln/bit-syncthing-2021-21404 <p><strong>Affected:</strong> Bitnami: syncthing</p> <p>Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it&#39;s likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.</p> <p><strong>Affected:</strong> Bitnami: syncthing</p> <p>Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it&#39;s likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.</p> https://cve.radiocsirt.org/vuln/bit-syncthing-2021-21404 https://cve.radiocsirt.org/vuln/euvd-2026-22235 EUVD-2026-22235 https://cve.radiocsirt.org/vuln/euvd-2026-22235 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21404 <p>Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it&#39;s likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.</p> <p>Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it&#39;s likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-21404 https://cve.radiocsirt.org/vuln/ghsa-x462-89pf-6r5h <p><strong>Affected:</strong> Go: github.com/syncthing/syncthing</p> <p>### Impact</p> <p>1. `syncthing` can be caused to crash and exit if sent a malformed relay protocol message message with a negative length field.</p> <p>2. The relay server `strelaysrv` can be caused to crash and exit if sent a malformed relay protocol message with a negative length field.</p> <p>At no point is sensitive data exposed or liable to be altered due to this issue. Sensitive data is never exposed to relay operators. Syncthing itself would need to be lured to connect to a malicious relay server in order to exploit the issue.</p> <p>### Patches</p> <p>Fixed in version 1.15.0.</p> <p>### Workarounds</p> <p>1. No known workaround for `strelaysrv`.</p> <p>2. `syncthing` can be configured to not use relays, or to only use specific, trusted relays. If Syncthing is used in a closed environment or with relaying disabled, i.e., it does not communicate with unknown relays, Syncthing is not vulnerable.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, please discuss it [on the forum](https://forum.syncthing.net/).</p> <p>Thanks to Wojciech Paciorek for discovering and reporting this issue.</p> <p><strong>Affected:</strong> Go: github.com/syncthing/syncthing</p> <p>### Impact</p> <p>1. `syncthing` can be caused to crash and exit if sent a malformed relay protocol message message with a negative length field.</p> <p>2. The relay server `strelaysrv` can be caused to crash and exit if sent a malformed relay protocol message with a negative length field.</p> <p>At no point is sensitive data exposed or liable to be altered due to this issue. Sensitive data is never exposed to relay operators. Syncthing itself would need to be lured to connect to a malicious relay server in order to exploit the issue.</p> <p>### Patches</p> <p>Fixed in version 1.15.0.</p> <p>### Workarounds</p> <p>1. No known workaround for `strelaysrv`.</p> <p>2. `syncthing` can be configured to not use relays, or to only use specific, trusted relays. If Syncthing is used in a closed environment or with relaying disabled, i.e., it does not communicate with unknown relays, Syncthing is not vulnerable.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, please discuss it [on the forum](https://forum.syncthing.net/).</p> <p>Thanks to Wojciech Paciorek for discovering and reporting this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-x462-89pf-6r5h https://cve.radiocsirt.org/vuln/gsd-2021-21404 gsd-2021-21404 https://cve.radiocsirt.org/vuln/gsd-2021-21404 https://cve.radiocsirt.org/vuln/opensuse-su-2021:0688-1 <p>Security update for syncthing</p> <p>Security update for syncthing</p> https://cve.radiocsirt.org/vuln/opensuse-su-2021:0688-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-21404 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: syncthing, Ubuntu:20.04:LTS: syncthing, Ubuntu:Pro:22.04:LTS: syncthing, Ubuntu:Pro:24.04:LTS: syncthing, Ubuntu:25.10: syncthing, Ubuntu:Pro:26.04:LTS: syncthing</p> <p>Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it&#39;s likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: syncthing, Ubuntu:20.04:LTS: syncthing, Ubuntu:Pro:22.04:LTS: syncthing, Ubuntu:Pro:24.04:LTS: syncthing, Ubuntu:25.10: syncthing, Ubuntu:Pro:26.04:LTS: syncthing</p> <p>Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it&#39;s likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-21404