Executive brief
SiYuan is a note-taking and knowledge management application. An unauthenticated attacker can exploit a flaw in the publish service's authentication rate-limiting mechanism to consume server memory and degrade service availability. By submitting repeated login attempts with different invalid usernames, an attacker forces the server to retain entries indefinitely, eventually exhausting resources and causing the service to become unresponsive.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) in the publish service's Basic Auth throttling mechanism. The throttle stores failed-attempt state using a key derived from the remote address and attacker-controlled username; however, there is no global capacity limit, periodic eviction, or time-to-live cleanup for entries. An unauthenticated attacker can send repeated authentication requests with unique invalid usernames, causing the throttle map to grow unbounded with persistent entries. Each unique username creates a new map entry that is never evicted, consuming memory and increasing synchronization overhead. The attack requires only network access and no credentials or user interaction. A fix is available in version 3.8.2, which implements bounded eviction policies and capacity constraints.
Affected products
- SiYuan SiYuan before 3.8.2
Timeline
- 2026-08-21: disclosed: GitHub Security Advisory GHSA-2x7j-p79w-7744 published
- 2026-09-04: advisory: CVE-2026-85584 and NVD listing published
- 2026-08-21: patched: Fix released in version 3.8.2