py-matrix-synapse -- malicious push rules may be used for a denial of service attack.

Matrix developers report:

“Push rules” can specify conditions under which they will match,
including event_match, which matches event content against a
pattern including wildcards.
Certain patterns can cause very poor performance in the matching
engine, leading to a denial-of-service when processing moderate
length events.