CVE-2026-85584
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.
- Published Sep 4, 2026
- CVSS 8.7 high
- 0.6% chance of exploitation in the next 30 days (EPSS)
- A fix is available