Denial of Service Vulnerability in SiYuan Publishing Platform
CVE-2026-85584

8.7HIGH

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85584?

SiYuan versions before v3.8.2 have a denial of service vulnerability related to the Basic Auth throttle in the publish-service. This flaw allows unauthenticated attackers to exploit the system by submitting repeated authentication requests using unique invalid usernames. The system currently lacks capacity limits and eviction policies for tracking failed attempts, which can lead to excessive memory use and significant synchronization overhead, ultimately degrading the availability of the service.

Affected Version(s)

siyuan 0 < 3.8.2

siyuan 3.8.2

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.