CVE-2026-85584: SiYuan before v3.8.2 Denial of Service via Auth Throttle
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.2 - Compensating control
Mitigate the DoS by limiting/controlling access to the SiYuan publish-service Basic Auth endpoint (e.g., via network ACL/WAF/rate limiting) to reduce repeated failed authentication attempts from unauthenticated clients.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to send authentication requests to the SiYuan publish service can exploit it. No valid credentials or user interaction are required.
What attack pattern triggers the denial of service?
The attacker repeatedly submits Basic Auth requests using distinct invalid usernames. Each unique username creates failed-attempt state without a stated capacity limit or eviction policy, consuming memory and increasing synchronization overhead.
Are all SiYuan versions affected?
The issue affects SiYuan versions before v3.8.2. Upgrading to v3.8.2 or later addresses the affected version range.