Denial of Service in SiYuan via Auth Throttle

Executive Summary

CVE-2026-85584 is a denial of service vulnerability in SiYuan versions before v3.8.2. It involves the publish-service Basic Auth throttle mechanism storing failed authentication attempts using attacker-controlled usernames without enforcing limits or cleanup policies. Attackers can send repeated requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual memory consumption in the SiYuan publish-service process. Check for repeated authentication failures with unique invalid usernames in logs. Use system monitoring tools like top, htop, or ps to observe memory usage spikes in the SiYuan service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause service degradation or complete unavailability of the SiYuan publish service due to memory exhaustion and increased system load. Users may experience slowdowns or inability to access the service during an attack.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability by causing memory exhaustion and service degradation through repeated unauthorized requests. While it does not directly expose or leak data, prolonged service unavailability could violate availability requirements in GDPR Article 32 and HIPAA Security Rule Section 164.308(a)(7), which mandate maintaining access to protected health information and personal data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.8.2 or later immediately. Implement rate limiting on authentication endpoints. Monitor memory usage and restart the service if abnormal growth is detected. Review logs for suspicious authentication attempts with unique invalid usernames.

Useful 0 Not Useful 0