CVE-2026-85585: SiYuan DOS Vulnerability via Mutex Leak

CVE-2026-85585 Overview

CVE-2026-85585 is an unbounded resource consumption vulnerability in SiYuan, an open-source personal knowledge management application. Versions prior to v3.8.2 contain a request-concurrency middleware that stores a mutex entry for every unique request path without any eviction mechanism. Unauthenticated remote attackers can repeatedly issue requests with distinct paths to grow the internal map indefinitely. Each new path permanently increases process memory and synchronization overhead, ultimately degrading service availability. The flaw is categorized under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated network attackers can permanently exhaust memory and synchronization primitives in SiYuan servers, resulting in a sustained denial-of-service condition against the note-taking application.

Affected Products

SiYuan versions prior to v3.8.2
SiYuan self-hosted server deployments exposed to untrusted networks
SiYuan instances relying on the controlConcurrency middleware

Discovery Timeline

2026-09-04 - CVE-2026-85585 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85585

Vulnerability Analysis

SiYuan implements a request-concurrency middleware that serializes handling of concurrent requests targeting the same URL path. The middleware maintains a mapping between request paths and their associated mutex objects. When a new request arrives, the middleware looks up an existing mutex for the path or creates one if none exists.

The implementation never removes entries from this map. Every distinct path processed by the server results in a permanent allocation of a mutex plus the associated map key. Because the HTTP request path is attacker-controlled and effectively unbounded in cardinality, remote clients can force the map to grow without limit.

Over time, the process retains one synchronization primitive per unique path observed. Memory footprint and lookup cost both scale linearly with the total number of unique paths seen since startup, not with the number of active concurrent requests.

Root Cause

The root cause is the absence of an eviction policy, expiration, or bounded cache on the mutex map maintained by the controlConcurrency middleware. The design assumes a fixed set of application routes but does not enforce that assumption against arbitrary attacker-supplied paths. This is a classic [CWE-400] uncontrolled resource consumption pattern in a caching data structure.

Attack Vector

Exploitation requires only network reachability to the SiYuan HTTP endpoint. An unauthenticated attacker sends a stream of HTTP requests, each with a unique path such as randomly generated URI suffixes. Each request causes the server to allocate a new mutex entry and retain it indefinitely. Sustained request generation grows the process heap and increases contention on the underlying map operations until availability degrades or the process is terminated by the operating system out-of-memory killer. Refer to the GitHub Security Advisory GHSA-p59v-3q54-qq55 and the VulnCheck Advisory on SiYuan for additional technical context.

Detection Methods for CVE-2026-85585

Indicators of Compromise

Sustained inbound HTTP traffic to a SiYuan instance featuring high-cardinality, randomized, or nonsensical URL paths from one or few source addresses.
Continual growth of the SiYuan process resident set size (RSS) that does not decrease during idle periods.
Increasing HTTP response latency correlated with request volume containing unique paths.

Detection Strategies

Monitor SiYuan process memory over time and alert on monotonic growth that persists across normal usage cycles.
Analyze web server or reverse proxy access logs for anomalous ratios of unique paths per source IP within short time windows.
Deploy rate-limiting counters keyed on distinct path count per client and alert when thresholds are exceeded.

Monitoring Recommendations

Instrument SiYuan hosts with memory and file-descriptor telemetry forwarded to a centralized logging or SIEM platform.
Track HTTP 5xx error rates and request latency on SiYuan endpoints as leading indicators of resource exhaustion.
Capture upstream reverse proxy metrics on path cardinality to identify enumeration or fuzzing behavior early.

How to Mitigate CVE-2026-85585

Immediate Actions Required

Upgrade all SiYuan installations to version v3.8.2 or later without delay.
Restrict network exposure of SiYuan to trusted networks or VPN clients while patching is planned.
Place SiYuan behind a reverse proxy that enforces per-source request rate limits and path validation.

Patch Information

The SiYuan maintainers addressed the vulnerability in version v3.8.2. The fix bounds the lifetime and size of the mutex map used by the request-concurrency middleware, preventing unbounded growth from attacker-supplied paths. Full remediation details are published in the SiYuan GitHub Security Advisory.

Workarounds

Deploy an HTTP reverse proxy such as NGINX or Caddy in front of SiYuan and restrict allowed URL paths to a known allowlist.
Configure connection and request rate limits at the proxy tier to cap unique paths accepted per source address per minute.
Require authentication at the proxy layer, for example via mutual TLS or HTTP basic auth, to eliminate unauthenticated exposure.
Restart the SiYuan process on a scheduled cadence as a temporary mitigation until the upgrade to v3.8.2 is completed.

bash

# Example NGINX rate-limit configuration to reduce exposure
limit_req_zone $binary_remote_addr zone=siyuan_rl:10m rate=10r/s;

server {
    listen 443 ssl;
    server_name siyuan.example.com;

    location / {
        limit_req zone=siyuan_rl burst=20 nodelay;
        proxy_pass http://127.0.0.1:6806;
    }
}