CVE-2026-85581

SiYuan before v3.8.2 contains a denial-of-service flaw (CWE-770, allocation of resources without limits) in its unauthenticated /api/system/uiproc endpoint, which accepts and retains attacker-controlled process identifiers with no size limits. A remote, unauthenticated attacker can send repeated requests with unique identifiers, causing the process to accumulate state and exhaust memory. The result is high-impact degradation of service availability (CVSS 4.0 scores availability impact only, with no confidentiality or integrity loss), so affected servers may slow down or become unresponsive until restarted. Any operator running a SiYuan instance before 3.8.2 whose API is reachable by untrusted clients — most relevantly self-hosted server deployments exposed to the network — is affected. Exploitation is not currently observed: no public proof-of-concept is known, EPSS estimates only a 0.3% chance of exploitation in the next 30 days (24th percentile), and the flaw is not in CISA's KEV catalog.

What to do: Upgrade SiYuan to v3.8.2 or later, which resolves the unbounded handling of process identifiers in /api/system/uiproc. Where upgrading is not immediately possible, restrict access to the API endpoint (and the API generally) to trusted networks or place it behind an authenticated reverse proxy, and monitor process memory for abnormal growth. Inventory deployments for internet-exposed SiYuan servers, since localhost-bound desktop-style instances are not meaningfully exposed to this network-based DoS.