SiYuan Unauthenticated DoS via Process ID Exhaustion

Executive Summary

CVE-2026-85581 is a denial of service vulnerability in SiYuan before v3.8.2. It affects the unauthenticated /api/system/uiproc endpoint which accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual memory usage or repeated requests to the /api/system/uiproc endpoint. Check application logs for excessive process identifier registrations. Use network monitoring tools to detect high-frequency requests to this endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause system slowdowns or crashes due to excessive memory consumption. It may lead to service unavailability for legitimate users, disrupting note-taking and data processing tasks. No special access or document modification is required to exploit it.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts service availability by allowing attackers to exhaust system memory through unauthenticated process identifier registration. While it does not directly expose or leak data, prolonged service degradation could interfere with data processing operations required for compliance with standards like GDPR or HIPAA, which mandate timely access to personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.8.2 or later. Implement authentication for the /api/system/uiproc endpoint. Set size limits for process identifiers and enforce expiration policies. Block or restrict access to the endpoint if not required.

Useful 0 Not Useful 0