CVE-2026-85581: SiYuan DOS Vulnerability in API Endpoint

CVE-2026-85581 Overview

CVE-2026-85581 is a denial of service vulnerability in SiYuan, a personal knowledge management application. The flaw resides in the unauthenticated /api/system/uiproc endpoint, which accepts and retains attacker-controlled process identifiers without enforcing size limits or authentication. Remote attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability. The vulnerability affects SiYuan versions before v3.8.2 and is tracked under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Unauthenticated remote attackers can exhaust memory of the SiYuan server process, causing sustained denial of service against knowledge base availability.

Affected Products

SiYuan versions prior to v3.8.2
SiYuan self-hosted deployments exposing the HTTP API
SiYuan instances reachable over the network without upstream authentication

Discovery Timeline

2026-09-04 - CVE-2026-85581 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85581

Vulnerability Analysis

The /api/system/uiproc endpoint in SiYuan registers UI process identifiers submitted by clients. The handler stores each supplied identifier in server-side memory without applying authentication, quota enforcement, or size limits. Because the endpoint is reachable without credentials, any network-adjacent attacker can call it repeatedly.

Each request contributes a new entry to the retained collection of process identifiers. Sustained submission of unique values causes unbounded memory growth in the SiYuan process. As memory consumption climbs, the host operating system begins swapping or terminating the process, producing a denial of service against the knowledge management service.

Root Cause

The root cause is missing input validation and missing resource governance on a public API. The endpoint lacks authentication checks, does not deduplicate submitted identifiers, imposes no cap on the total number of retained entries, and enforces no size limit on individual identifier values. This aligns with CWE-770, which describes allocation of resources without limits or throttling.

Attack Vector

The attack requires only network reachability to the SiYuan HTTP interface. No user interaction and no privileges are required. An attacker issues repeated HTTP POST requests to /api/system/uiproc, supplying a distinct process identifier in each request. A short loop executed from a single host is sufficient to inflate the server's resident memory footprint until the process is killed or becomes unresponsive.

The vulnerability affects availability only. Confidentiality and integrity of stored notes are not directly impacted, but sustained exploitation prevents legitimate users from accessing the service. See the GitHub Security Advisory GHSA-wv96-wmf5-xvj2 and the VulnCheck advisory for additional technical detail.

Detection Methods for CVE-2026-85581

Indicators of Compromise

Repeated HTTP POST requests to /api/system/uiproc from a single source address within a short time window.
Steady growth in resident memory usage of the SiYuan process without a corresponding increase in legitimate user activity.
SiYuan process terminations by the operating system out-of-memory killer or container runtime.
Unauthenticated requests to /api/system/uiproc originating from external network ranges.

Detection Strategies

Deploy web server or reverse proxy access logging and alert on high request rates to /api/system/uiproc.
Correlate application memory metrics with HTTP request volume to identify resource-exhaustion patterns.
Baseline normal /api/system/uiproc traffic and flag deviations in unique identifier counts per source.

Monitoring Recommendations

Instrument the SiYuan host with memory and process-lifetime metrics forwarded to your monitoring platform.
Enable rate-limiting metrics at the reverse proxy layer and alert on threshold breaches.
Retain HTTP access logs for the SiYuan API to support post-incident review of exploitation attempts.

How to Mitigate CVE-2026-85581

Immediate Actions Required

Upgrade SiYuan to version v3.8.2 or later, which addresses the unbounded allocation in the /api/system/uiproc handler.
Restrict network access to the SiYuan HTTP interface using firewall rules, VPN, or a reverse proxy with authentication.
Place SiYuan behind a reverse proxy that enforces rate limiting on /api/system/uiproc.
Monitor SiYuan process memory and configure automatic restart on abnormal growth.

Patch Information

The SiYuan maintainers released version v3.8.2 to remediate CVE-2026-85581. Refer to the GitHub Security Advisory GHSA-wv96-wmf5-xvj2 for release notes and upgrade instructions. Users running self-hosted or containerized deployments should pull the updated release and redeploy.

Workarounds

Block external access to /api/system/uiproc at the reverse proxy or web application firewall until patching is possible.
Enforce authentication at an upstream proxy so unauthenticated requests never reach the SiYuan API.
Apply per-source rate limits and connection quotas to the SiYuan endpoint.
Run SiYuan under a container or systemd unit with a hard memory limit to bound the impact of exploitation.

bash

# Example nginx snippet: restrict and rate-limit the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=siyuan_uiproc:10m rate=5r/m;

server {
    listen 443 ssl;
    server_name siyuan.example.com;

    location = /api/system/uiproc {
        allow 10.0.0.0/8;
        deny all;
        limit_req zone=siyuan_uiproc burst=5 nodelay;
        proxy_pass http://127.0.0.1:6806;
    }

    location / {
        proxy_pass http://127.0.0.1:6806;
    }
}