CVE-2026-85585 in SiYuan
Summary
by MITRE • 09/04/2026
SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory and synchronization overhead, degrading availability.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in SiYuan versions prior to 3.8.2 represents a critical unbounded resource consumption flaw located within the application's request-concurrency middleware. This component is responsible for managing concurrent access to shared resources by utilizing mutex locks to ensure thread safety and data integrity during high-traffic operations. However, the implementation fails to implement an eviction policy or size limit for the internal map that tracks these mutex entries based on unique request paths. Consequently, every distinct URL path requested by a client results in the allocation of a new synchronization object within the application's memory space, regardless of whether subsequent requests utilize those same paths. This architectural oversight transforms what should be a transient operational state into a persistent and growing resource burden that accumulates over time without any mechanism for garbage collection or cleanup of unused entries.
From an offensive perspective, this flaw allows unauthenticated attackers to exploit the lack of path normalization or caching limits by generating a high volume of requests with unique, randomly generated URL paths. Since each new path triggers the creation and retention of a mutex entry in memory, the attacker can systematically exhaust the server's available RAM. As the number of tracked entries grows into the millions, the application experiences significant performance degradation due to increased memory pressure and potential swapping to disk. Furthermore, the synchronization overhead associated with managing such an excessive number of locks introduces substantial latency for legitimate users attempting to access valid endpoints. This effectively creates a denial-of-service condition where the service becomes unresponsive or crashes entirely under sustained attack load, compromising the availability aspect of the CIA triad without requiring any form of authentication or privilege escalation.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically manifesting as excessive memory allocation due to a lack of bounds checking on dynamic data structures. In terms of adversarial tactics, this behavior is consistent with ATT&CK technique T1496, Resource Hijacking, where an attacker consumes computational resources to degrade service availability for other users. The attack vector relies primarily on network connectivity and the ability to send HTTP requests, making it accessible via remote exploitation without prior access credentials. The persistence of these mutex entries indicates a failure in implementing standard caching strategies such as Least Recently Used (LRU) eviction or maximum capacity limits that are common practice in high-performance web middleware designs.
Mitigation for this vulnerability requires immediate patching to version 3.8.2 or later, where the developers have addressed the concurrency handling logic by introducing proper lifecycle management for mutex entries. For environments unable to upgrade immediately, defensive measures should focus on implementing rate limiting at the network perimeter using Web Application Firewalls (WAF) to restrict the number of unique paths a single IP address can request within a given timeframe. Additionally, enforcing strict URL path validation and canonicalization can reduce the entropy of incoming requests, thereby lowering the likelihood of generating excessive unique entries. Monitoring server memory usage for anomalous spikes correlated with HTTP traffic patterns can also serve as an early detection mechanism to identify ongoing exploitation attempts before total service failure occurs.