Executive brief
SiYuan's publish service is a component that handles authentication for publishing content. An authenticated attacker can repeatedly authenticate with valid credentials to create unlimited session entries that never expire, causing the application to consume memory indefinitely until it becomes unavailable. This denial-of-service attack does not leak data but can crash the service.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) in SiYuan's publish-service Basic Auth handler. Each successful authentication creates a persistent session entry in a global registry with no TTL, capacity limit, or session reuse mechanism. An authenticated attacker (or someone with valid publish credentials) can send repeated authentication requests, each generating a new distinct session object that remains in memory indefinitely. The attack requires valid credentials and network access to the publish service, but no user interaction or privilege escalation. An attacker can cause unbounded in-memory growth, degrading availability until the process is out of memory. The vulnerability is fixed in SiYuan v3.8.2 and later.
Affected products
- SiYuan SiYuan before v3.8.2
Timeline
- 2026-08-21: disclosed
- 2026-09-04: advisory
- 2026: patched: v3.8.2