CVE-2026-85582

SiYuan, an open-source self-hosted note-taking and knowledge-management application, contains an unbounded session-creation flaw (CWE-770) in the Basic Auth handler of its publish service. An attacker holding valid Basic Auth credentials can repeatedly authenticate against a network-reachable publish endpoint; each successful login creates a persistent session entry with no expiry or capacity limit, driving unbounded process memory growth until the SiYuan process is starved and denied service. The flaw has no confidentiality or integrity impact (CVSS 4.0 7.1, high availability impact) and requires valid credentials, so it is limited to attackers who can reach the publish service and authenticate to it. All SiYuan deployments running versions before v3.8.2 with the publish service enabled are affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Upgrade SiYuan to v3.8.2 or later. Until then, restrict reachability of the publish service (firewall rules, bind to trusted networks or VPN), ensure Basic Auth credentials are strong and limited to trusted users, and monitor or periodically restart the SiYuan process to bound memory growth.