CVE-2026-85585

SiYuan before v3.8.2 contains an uncontrolled resource consumption flaw (CWE-400) in its request-concurrency middleware, which records a mutex entry for every unique request path and never evicts them. An unauthenticated remote attacker triggers it simply by sending requests across many distinct paths, and each new path permanently adds to the process's memory footprint and synchronization (lock) overhead until the process is restarted. The attacker gains degradation of availability — growing memory and lock contention can slow or effectively halt the service — with no confidentiality or integrity impact. Anyone running an affected SiYuan version as a network-reachable server is affected, with the highest risk for instances exposed to untrusted users or the internet (locally bound desktop-only instances face far less risk). No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates only about a 0.4% probability of exploitation within 30 days.

What to do: Upgrade SiYuan to version 3.8.2 or later, which fixes the middleware leak. Until you can upgrade, restrict network access to the instance (bind to localhost, or place it behind a VPN, firewall, or authenticated reverse proxy) and periodically restart the process to clear the accumulated mutex entries; watch for unexplained memory growth in the SiYuan process as an indicator of probing.