CVE-2026-85582
Received Received - Intake

SiYuan Session Exhaustion via Unbounded Auth Handler

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite process memory growth and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85582
EUVD
EUVD-2026-71005

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions before v3.8.2 have a flaw where the publish-service Basic Auth handler allows unlimited session creation. Attackers with valid credentials can repeatedly create persistent sessions without expiry or limits, causing indefinite memory growth and system crashes due to memory exhaustion.

Detection Guidance

Monitor for excessive memory usage in the SiYuan application process, particularly in the publish-service component. Check for a growing number of active sessions in the publish session registry without corresponding logout events. Use system monitoring tools like top, htop, or ps to observe memory consumption trends.

Impact Analysis

This vulnerability can lead to denial of service by consuming all available memory, making the application unresponsive or crashing. It requires authenticated access, so attackers must have valid credentials to exploit it.

Compliance Impact

This vulnerability primarily causes denial of service through memory exhaustion, which could lead to system unavailability. While not directly exposing data, prolonged outages may impact data access required for compliance with GDPR (data availability) or HIPAA (system availability for protected health information). However, the vulnerability does not directly violate these standards as it does not involve unauthorized data access or disclosure.

Mitigation Strategies
  • Upgrade SiYuan to version 3.8.2 or later to address the unbounded session creation issue.
  • Implement session expiration policies with time-to-live (TTL) limits for authenticated sessions.
  • Enforce per-user session limits and eviction policies to prevent memory exhaustion.
  • Reuse existing sessions for the same authenticated user instead of creating new ones repeatedly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart