CVE-2026-85581 in SiYuan
Summary
by MITRE • 09/04/2026
SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The SiYuan note-taking application, prior to version 3.8.2, contains a critical denial of service vulnerability within its unauthenticated API endpoint located at /api/system/uiproc. This flaw stems from the server's failure to implement proper input validation and resource management mechanisms when handling process identifiers submitted by clients. The endpoint is designed to accept user-provided process IDs for system monitoring or tracking purposes, but it lacks any form of authentication requirement, allowing unauthenticated actors to interact with this functionality directly over the network without needing valid credentials. This lack of access control represents a significant security oversight that exposes internal system management functions to external abuse.
The technical nature of this vulnerability involves an absence of size limits and quantity restrictions on the process identifiers retained by the server. When attackers send repeated requests containing unique, attacker-controlled process identifiers, the application stores these entries in memory without enforcing any maximum capacity or expiration policy. Over time, as more unique identifiers are submitted, the application's memory consumption grows linearly with each request. This unbounded accumulation of data structures leads to a gradual but inevitable exhaustion of available system resources. The vulnerability is classified under CWE-787: Out-of-bounds Write if it involves buffer overflows, or more accurately in this context as CWE-400: Uncontrolled Resource Consumption, specifically manifesting as a resource leak that prevents the application from reclaiming memory for unused entries.
The operational impact of exploiting this vulnerability is severe, resulting in a complete denial of service condition for legitimate users. As the server's memory usage increases due to the retention of thousands or millions of unnecessary process identifier records, the application begins to experience performance degradation characterized by increased latency and sluggish response times. Eventually, the system will reach its memory limits, causing the SiYuan service to crash or become unresponsive. This effectively renders the note-taking platform unavailable until the service is restarted or manually cleared, disrupting productivity for all users relying on the application. The attack requires no special privileges, making it easily executable by any remote attacker with network access to the vulnerable endpoint.
This vulnerability aligns with MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under the sub-technique of resource exhaustion via uncontrolled consumption. Attackers can automate this process using simple scripts that continuously send POST requests to the /api/system/uiproc endpoint with varying unique identifiers, creating a sustained pressure on server resources. The lack of rate limiting or request throttling exacerbates the issue, allowing for rapid depletion of system memory within minutes depending on the volume of traffic generated.
To mitigate this vulnerability, immediate action is required by upgrading SiYuan to version 3.8.2 or later where these issues have been addressed. In addition to updating software, administrators should implement network-level protections such as rate limiting and request throttling for all API endpoints, particularly those that are unauthenticated but handle stateful data. Input validation must be enforced to ensure that process identifiers meet expected format constraints and length limits. Furthermore, implementing a maximum retention policy or cache expiration mechanism would prevent the indefinite accumulation of unused entries in memory. Regular security audits focusing on resource management practices can help identify similar vulnerabilities before they are exploited in production environments.