CVE-2026-85585: SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency
SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory and synchronization overhead, degrading availability.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SiYuan versions before 3.8.2 are affected. Any reachable instance is exposed because exploitation does not require authentication.
What does an attacker need to do to cause impact?
An attacker can send requests using many distinct request paths. Each unique path causes the concurrency middleware to retain another mutex entry without eviction, increasing memory use and synchronization overhead.
What is the likely operational impact?
The issue affects availability: retained entries permanently grow process memory consumption and synchronization overhead, which can degrade the service over time. No confidentiality or integrity impact is indicated by the supplied severity vector.