CVE-2026-85582: SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite process memory growth and denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.8.2
Event History
Frequently Asked Questions
What access does an attacker need to trigger the memory exhaustion?
An attacker needs valid credentials for the publish-service Basic Auth handler. No user interaction is required, and the attack can be performed over the network.
Which deployments are affected?
SiYuan versions before v3.8.2 are affected where the publish-service Basic Auth handler is available to authenticated users. The issue is caused by session entries that have no expiry or capacity limits.
What is the remediation?
Upgrade SiYuan to v3.8.2 or later. The provided information does not identify a separate workaround for deployments that cannot be upgraded immediately.