CVE-2026-33203: B3log Siyuan DOS Vulnerability

CVE-2026-33203 Overview

SiYuan is a personal knowledge management system that allows users to organize notes, documents, and knowledge bases locally. A critical vulnerability exists in versions prior to 3.6.2 where the SiYuan kernel WebSocket server accepts unauthenticated connections when a specific "auth keepalive" query parameter is present. After connection establishment, incoming messages are parsed using unchecked type assertions on attacker-controlled JSON data. A remote attacker can exploit this flaw by sending malformed messages that trigger a runtime panic, potentially crashing the kernel process and causing denial of service.

Critical Impact

Remote attackers can crash the SiYuan kernel process without authentication, causing complete denial of service and potential data loss for users actively working in the application.

Affected Products

• B3log SiYuan versions prior to 3.6.2
• SiYuan kernel WebSocket server component
• All platforms running vulnerable SiYuan versions

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-33203 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33203

Vulnerability Analysis

The vulnerability resides in the SiYuan kernel's WebSocket server implementation. The core issue stems from improper handling of WebSocket connections and message parsing. When a client connects to the WebSocket server with a specially crafted "auth keepalive" query parameter, the server bypasses normal authentication checks and accepts the connection as valid.

Once connected, the server processes incoming JSON messages using unchecked type assertions. In Go (the language SiYuan is written in), type assertions without the "comma ok" idiom will cause a runtime panic if the assertion fails. An attacker can exploit this behavior by sending JSON payloads that do not conform to the expected type structure, causing the application to panic and terminate.

This represents a significant security concern for users who may expose their SiYuan instance on a network, as any unauthenticated remote attacker can repeatedly crash the application.

Root Cause

The root cause is twofold: first, an authentication bypass exists when specific query parameters are present in WebSocket connection requests. Second, the message parsing logic uses unsafe type assertions on attacker-controlled data without proper validation or error handling. This combination allows unauthenticated attackers to trigger runtime panics through crafted malicious payloads. The vulnerability is classified under CWE-248 (Uncaught Exception), indicating that the application fails to properly handle exceptional conditions in user input.

Attack Vector

The attack vector is network-based and requires no user interaction or authentication. An attacker can establish a WebSocket connection to a vulnerable SiYuan instance by including the "auth keepalive" query parameter. Once connected, the attacker sends malformed JSON messages designed to fail type assertions during parsing. When the unchecked type assertion encounters unexpected data types, it triggers a runtime panic that crashes the entire kernel process.

The attack is particularly dangerous because it can be executed remotely, requires no privileges, and results in immediate denial of service. Repeated exploitation can prevent users from accessing their knowledge base entirely.

Detection Methods for CVE-2026-33203

Indicators of Compromise

• Unexpected WebSocket connections to the SiYuan kernel server with "auth keepalive" query parameters
• Repeated SiYuan kernel process crashes or restarts
• Log entries showing runtime panic exceptions related to type assertion failures
• Unusual network traffic patterns targeting the SiYuan WebSocket endpoint

Detection Strategies

• Monitor WebSocket connection logs for connections containing suspicious query parameters
• Implement network-level monitoring for repeated connection attempts to SiYuan services
• Set up process monitoring to detect unexpected kernel crashes and automatic restarts
• Review application logs for panic stack traces indicating type assertion failures

Monitoring Recommendations

• Configure alerting for SiYuan process termination events
• Implement network traffic analysis to identify potential exploitation attempts
• Monitor for high-frequency WebSocket connection patterns from single IP addresses
• Enable verbose logging in SiYuan to capture detailed connection and message information

How to Mitigate CVE-2026-33203

Immediate Actions Required

• Upgrade to SiYuan version 3.6.2 or later immediately
• Restrict network access to SiYuan instances using firewall rules
• If upgrade is not immediately possible, consider running SiYuan in a local-only configuration
• Review logs for any signs of exploitation attempts

Patch Information

Version 3.6.2 of SiYuan addresses this vulnerability by implementing proper authentication checks for WebSocket connections and adding safe type assertion handling with error recovery. Users should update to the latest version as soon as possible. The security advisory is available at the GitHub Security Advisory page.

Workarounds

• Restrict SiYuan to localhost-only access using firewall rules or binding to 127.0.0.1
• Place SiYuan behind a reverse proxy with authentication requirements
• Use network segmentation to limit exposure of the SiYuan service
• Monitor and rate-limit incoming WebSocket connections

# Firewall configuration example to restrict SiYuan access
# Allow only localhost connections to SiYuan (default port 6806)
iptables -A INPUT -p tcp --dport 6806 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 6806 -j DROP