CVE-2026-85582: SiYuan Unbounded Session Creation DoS

CVE-2026-85582 Overview

CVE-2026-85582 is an unbounded resource allocation vulnerability [CWE-770] in SiYuan, an open-source personal knowledge management system. Versions prior to v3.8.2 contain a flaw in the publish-service Basic Auth handler that allows authenticated attackers to exhaust process memory. Each successful authentication creates a persistent session entry with no expiry or capacity limit. Attackers with valid credentials can repeatedly authenticate to force indefinite memory growth, resulting in denial of service.

Critical Impact
An authenticated attacker can crash the SiYuan publish service by exhausting host memory through repeated Basic Auth requests, producing sustained availability loss.

Affected Products

SiYuan versions before v3.8.2
SiYuan publish-service component using Basic Auth
Deployments exposing the publish service over the network

Discovery Timeline

2026-09-04 - CVE-2026-85582 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85582

Vulnerability Analysis

The vulnerability resides in the publish-service Basic Auth handler. Each authenticated request creates a new session record and appends it to an in-memory store. The handler does not enforce session expiry, deduplication by principal, or a maximum capacity. As a result, repeated authentications by the same authorized user produce unbounded growth in the session map.

The attack requires valid credentials but does not require administrative privileges. Any account permitted to authenticate against the publish service can trigger the condition. The service memory footprint grows linearly with request volume until the operating system terminates the process or the host becomes unresponsive.

Root Cause

The root cause is missing resource management in the session lifecycle. The Basic Auth code path allocates session state on every call, and no reaping mechanism removes stale entries. This design pattern matches [CWE-770: Allocation of Resources Without Limits or Throttling]. Because Basic Auth clients typically do not maintain session cookies, each request produces a fresh allocation instead of reusing an existing session.

Attack Vector

An attacker with valid credentials sends repeated HTTP requests to the publish-service endpoint using the Authorization: Basic header. Each request forces the server to allocate and retain a new session object. Sustained request volume causes memory pressure, garbage collection thrashing, and eventual out-of-memory termination. The attack is network-reachable and requires no user interaction.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-f4vj-ppp2-5hg4 and the VulnCheck Advisory on Unbounded Session Creation for full technical details.

Detection Methods for CVE-2026-85582

Indicators of Compromise

High-frequency HTTP requests to the publish-service endpoint carrying Authorization: Basic headers from a single source
Steadily increasing resident memory (RSS) of the SiYuan process without a corresponding rise in user activity
Repeated successful authentication log entries for the same principal within short time windows
Out-of-memory events or process restarts affecting the SiYuan service

Detection Strategies

Baseline normal Basic Auth request rates per user and alert on statistical outliers targeting the publish service
Correlate authentication log volume with SiYuan process memory metrics to surface abuse patterns
Monitor for HTTP 401/200 response ratios that indicate credential replay or scripted authentication loops

Monitoring Recommendations

Instrument the SiYuan host with process-level memory telemetry and forward it to a centralized logging pipeline
Track container or systemd restart counts for the SiYuan service as a proxy for availability degradation
Ingest reverse-proxy access logs to enable per-source request-rate analytics against publish-service routes

How to Mitigate CVE-2026-85582

Immediate Actions Required

Upgrade SiYuan to v3.8.2 or later on all deployments running the publish service
Restrict network exposure of the publish service to trusted networks or VPN-reachable clients only
Rotate credentials for any accounts authorized to access the publish service, especially if shared
Place SiYuan behind a reverse proxy that enforces per-IP and per-user request rate limits

Patch Information

The issue is resolved in SiYuan v3.8.2. Consult the GitHub Security Advisory GHSA-f4vj-ppp2-5hg4 for release notes and fix details. Operators should validate the upgraded version by checking the running binary version string after deployment.

Workarounds

Front the publish service with a reverse proxy such as NGINX or HAProxy that applies request rate limits and connection caps per source
Disable the publish service if it is not required for the deployment
Enforce network-layer access controls that restrict Basic Auth traffic to a small set of known clients
Configure host-level memory limits (cgroups or container quotas) to contain the impact of allocation abuse

bash

# Example NGINX rate limit for the SiYuan publish endpoint
limit_req_zone $binary_remote_addr zone=siyuan_auth:10m rate=5r/m;

server {
    listen 443 ssl;
    server_name siyuan.example.com;

    location / {
        limit_req zone=siyuan_auth burst=10 nodelay;
        proxy_pass http://127.0.0.1:6806;
    }
}