CVE-2026-85584 in SiYuan
Summary
by MITRE • 09/04/2026
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The security flaw identified in SiYuan versions prior to v3.8.2 represents a significant denial of service vulnerability rooted in the improper handling of stateful data within the publish-service authentication mechanism. Specifically, the Basic Authentication throttle logic is designed to track failed login attempts to prevent brute-force attacks by temporarily locking out accounts after a threshold of failures is reached. However, the implementation fails to enforce capacity limits or implement eviction policies for this tracking state when the input usernames are controlled by an attacker. This architectural oversight allows unauthenticated actors to exploit the system's memory management and synchronization processes through sustained resource exhaustion techniques.
From a technical perspective, the vulnerability arises because the throttle mechanism stores failed-attempt states using the provided username as a key without any upper bound on the number of stored entries or time-based expiration for non-existent accounts. When an attacker submits repeated authentication requests with unique, invalid usernames, each request results in the creation and storage of a new state entry corresponding to that specific username string. Since there is no mechanism to evict these stale entries after a reasonable period or limit the total number of tracked failures across all users, the application's memory footprint grows linearly with the volume of attack traffic. This unbounded growth directly impacts system stability by consuming available heap space and increasing garbage collection overhead, which in turn degrades overall service performance.
The operational impact of this vulnerability is severe for any deployment relying on SiYuan’s publish-service functionality. As memory consumption escalates due to the accumulation of failed attempt records, the application experiences increased latency and higher synchronization overhead across its distributed components if applicable. In extreme cases, the continuous allocation of memory without release can lead to an out-of-memory condition, causing the service process to crash or become unresponsive. This effectively results in a denial of service for legitimate users who are unable to access their notes or synchronize data during the attack window. The vulnerability is particularly dangerous because it requires no authentication credentials, allowing any internet-facing instance with publish-service enabled to be targeted by low-cost automated scripts that generate high volumes of unique usernames.
This flaw aligns closely with CWE-787: Out-of-bounds Write and CWE-400: Uncontrolled Resource Consumption, as the system fails to limit the resources allocated for tracking authentication failures. In terms of offensive security frameworks, this behavior is characteristic of ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-methods involving resource exhaustion through application layer attacks. The lack of rate limiting based on unique identifier count rather than just IP address allows attackers to bypass simple per-IP throttling measures by rotating the username field for each request.
To mitigate this vulnerability, it is imperative that system administrators upgrade SiYuan to version v3.8.2 or later, where these capacity limits and eviction policies have been implemented. For environments where immediate upgrading is not feasible, defensive configurations should be applied at the network perimeter level. Implementing strict rate limiting on authentication endpoints based on both IP address and unique username patterns can help mitigate the impact of such attacks. Additionally, deploying a Web Application Firewall with rules designed to detect and block rapid sequences of failed login attempts using distinct identifiers can provide an effective layer of defense against this specific resource exhaustion vector until the underlying software defect is patched.