CVE-2026-85584

SiYuan versions before v3.8.2 contain a resource-exhaustion flaw (CWE-770) in the Basic Auth throttle of its publish service, which records failed-login state keyed by attacker-supplied usernames with no capacity limit or eviction policy. An unauthenticated remote attacker who can reach the publish service can send repeated authentication attempts using unique invalid usernames, causing the stored state to grow until memory is exhausted and synchronization overhead rises. The impact is a denial of service degrading availability only; the CVSS 4.0 score of 8.7 shows no confidentiality or integrity impact. Any SiYuan deployment running a vulnerable version with the publish service reachable by unauthenticated users is affected. Exploitation has not been observed: there is no known public PoC, it is not in CISA KEV, and EPSS is low at 0.3% over 30 days.

What to do: Upgrade SiYuan to v3.8.2 or later, which fixes the throttle state handling. Until then, restrict network access to the publish service (e.g., firewall or reverse-proxy allowlists and rate limiting on authentication requests) and verify whether the publish endpoint is exposed to the internet. Monitor memory usage on affected instances, since exhaustion is the primary symptom.