Executive brief
SiYuan is a popular open-source note-taking and knowledge management application. The application contains an unauthenticated API endpoint that accepts and indefinitely stores user-supplied process identifiers without any limits. An attacker can exploit this by sending thousands of requests with unique identifiers, causing the application to consume excessive memory and become unavailable to legitimate users.
Technical details
A resource exhaustion vulnerability exists in the /api/system/uiproc endpoint, which registers UI-process identifiers without authentication, input validation, or size limits. The endpoint adds attacker-controlled identifiers to an in-memory registry with no bounds or reliable expiration mechanism. An unauthenticated network attacker can send repeated requests with unique process IDs to cause unbounded memory growth, degrading performance or causing denial of service. The vulnerability is patched in version 3.8.2; affected versions are v3.8.1 and earlier.
Affected products
- SiYuan SiYuan before v3.8.2
Timeline
- 2026-08-21: disclosed: GitHub Security Advisory GHSA-wv96-wmf5-xvj2 published
- 2026-08-21: patched: Fix released in v3.8.2
- 2026-09-04: advisory: CVE-2026-85581 assigned and published