Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85584SiYuan before v3.8.2 Denial of Service via Auth Throttle

High 7.5

In plain English

A high-severity resource allocation without limits in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 51.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.8.2

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-2x7j-p79w-7744) vendor-advisory
VulnCheck Advisory: SiYuan before v3.8.2 Denial of Service via Auth Throttle third-party-advisory