Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck
CVE-2026-85585SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency
High 7.5
In plain English
A high-severity uncontrolled resource consumption in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 56.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory and synchronization overhead, degrading availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | 0 – before 3.8.2 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-p59v-3q54-qq55) vendor-advisory
- VulnCheck Advisory: SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency third-party-advisory