Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85582SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth

Medium 6.5

In plain English

A medium-severity resource allocation without limits in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite process memory growth and denial of service.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.8.2

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-f4vj-ppp2-5hg4) vendor-advisory
VulnCheck Advisory: SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth third-party-advisory