CVE-2026-109310
Deferred Deferred - Pending Action

SiYuan Kernel Resource Exhaustion via Sprig Template Function

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109310
EUVD
EUVD-2026-97612

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan-note siyuan 3.1.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions 3.1.12 through 3.8.5 are vulnerable to a Denial of Service (DoS) attack via the getDynamicIcon template function. The application fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing attackers to exploit uncapped functions like 'until' to exhaust system resources. This can lead to an Out-of-Memory (OOM) condition, crashing the kernel with a single request.

Detection Guidance

Monitor for unusual memory consumption spikes or kernel crashes when accessing the /api/icon/getDynamicIcon endpoint. Check logs for requests with large content parameters or repeated calls to template functions like 'until'.

Impact Analysis

A publish reader or anyone when publish auth is disabled can send a crafted request to the /api/icon/getDynamicIcon endpoint with a large integer value in the content parameter. This causes the server's kernel process to terminate due to excessive memory consumption, crashing the owner's workspace. A single request can consume several gigabytes of memory.

Mitigation Strategies

Upgrade SiYuan to version 3.8.6 or later. If immediate upgrade is not possible, restrict access to the /api/icon/getDynamicIcon endpoint or disable publish authentication if not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart