CVE-2026-85584: SiYuan Publish Service DoS Vulnerability

CVE-2026-85584 Overview

CVE-2026-85584 is a denial of service vulnerability affecting SiYuan versions before v3.8.2. The flaw resides in the publish-service Basic Auth throttle, which tracks failed authentication attempts using attacker-controlled usernames as keys. The implementation enforces no capacity limit and no eviction policy on this state map. Unauthenticated remote attackers can flood the service with authentication requests containing unique invalid usernames. Each request expands the throttle state, exhausting memory and increasing synchronization overhead until service availability degrades. The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact

Unauthenticated remote attackers can exhaust server memory and degrade SiYuan availability by submitting authentication requests with unique invalid usernames.

Affected Products

• SiYuan note-taking application versions before v3.8.2
• Deployments exposing the publish-service Basic Auth endpoint
• Self-hosted SiYuan instances reachable from untrusted networks

Discovery Timeline

• 2026-09-04 - CVE-2026-85584 published to the National Vulnerability Database
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85584

Vulnerability Analysis

SiYuan exposes a publish-service protected by HTTP Basic Authentication. To slow brute-force attacks, the service maintains a throttle that records failed authentication attempts. The throttle stores per-username counters and timestamps in an in-memory structure keyed by the username supplied in the Authorization header. Because that key is attacker-controlled, an attacker who submits unique username values on every request causes the map to grow unbounded. No cap on entries exists, and no eviction policy removes stale records. Concurrent access to the shared structure also introduces lock contention that compounds resource pressure. The result is memory exhaustion and degraded responsiveness for legitimate users.

Root Cause

The root cause is unbounded resource allocation [CWE-770]. The throttle treats the username as a trusted, low-cardinality identifier, but Basic Auth allows any client to supply an arbitrary string. Absent a maximum entry count, a time-to-live, or a least-recently-used eviction policy, the state map grows for every distinct invalid username observed.

Attack Vector

Exploitation requires network access to the publish-service endpoint and no authentication or user interaction. An attacker issues repeated HTTP requests carrying Authorization: Basic headers, each encoding a fresh random username and any password. Each request adds a new entry to the throttle map. Sustained request volume drives memory consumption upward and increases contention on synchronization primitives that guard the shared structure, causing latency and eventual denial of service.

Refer to the GitHub Security Advisory GHSA-2x7j-p79w-7744 and the VulnCheck Denial of Service Advisory for additional context.

Detection Methods for CVE-2026-85584

Indicators of Compromise

• Sustained volume of HTTP requests to publish-service endpoints carrying Authorization: Basic headers with high-entropy or non-repeating usernames.
• Rapid growth in SiYuan process resident memory without a matching increase in legitimate user activity.
• Elevated response latency or timeouts on the SiYuan publish endpoint during periods of concentrated authentication traffic.

Detection Strategies

• Monitor authentication logs for a high ratio of unique usernames per source IP within short time windows.
• Baseline SiYuan memory and CPU utilization, and alert on sudden upward deviations that correlate with inbound HTTP request spikes.
• Deploy web application firewall rules that count distinct Basic Auth usernames per client and flag statistical anomalies.

Monitoring Recommendations

• Ingest SiYuan access logs into a centralized analytics platform and build queries for Authorization: Basic request patterns.
• Track process-level memory metrics for the SiYuan service and alert on rapid growth trends.
• Correlate reverse-proxy request rates with backend latency to detect throttle-driven degradation early.

How to Mitigate CVE-2026-85584

Immediate Actions Required

• Upgrade SiYuan to version 3.8.2 or later, which addresses the unbounded throttle state.
• Restrict network access to the publish-service endpoint through firewall or reverse-proxy allow-lists.
• Place SiYuan behind a reverse proxy that enforces per-IP request rate limits on authentication endpoints.

Patch Information

The SiYuan maintainers resolved CVE-2026-85584 in version 3.8.2. Deployment details and the fix reference are available in the GitHub Security Advisory GHSA-2x7j-p79w-7744. Administrators unable to upgrade immediately should apply the network-level workarounds described below.

Workarounds

• Enforce rate limits on requests to the publish-service Basic Auth endpoint at the reverse proxy or WAF layer.
• Require authentication at an upstream proxy so SiYuan never processes anonymous Basic Auth attempts from the internet.
• Cap available memory for the SiYuan process using container or systemd resource limits to contain the impact of exhaustion.

# Example NGINX rate limiting for the SiYuan publish endpoint
http {
    limit_req_zone $binary_remote_addr zone=siyuan_auth:10m rate=5r/s;

    server {
        listen 443 ssl;
        server_name siyuan.example.com;

        location / {
            limit_req zone=siyuan_auth burst=10 nodelay;
            limit_req_status 429;
            proxy_pass http://127.0.0.1:6806;
        }
    }
}