EUVD-2026-71004
GHSA-4qv4-f447-c9m2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-accessible SiYuan API port
-
DeliverySend repeated HTTP requests to /api/system/uiproc
-
ExploitSupply unique process identifiers per request
-
ExecutionServer accumulates identifiers in memory without eviction
-
PersistProcess memory exhausted
-
ImpactSiYuan service crashes or becomes unresponsive
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required - the /api/system/uiproc endpoint is exposed without access control by design. The sole prerequisite is network connectivity to the SiYuan API port (default TCP 6806). In default personal-use deployments, SiYuan binds to localhost, restricting exploitation to processes on the same host (effectively local access only). Internet-facing exploitation requires the instance to be configured for remote access or to have the API port exposed through a reverse proxy or firewall without source-IP restrictions. No specific feature flag needs to be enabled; the vulnerable endpoint is present in all default SiYuan installations prior to v3.8.2. |
| Impact | The CVSS 4.0 score of 8.7 accurately reflects the trivially automatable, unauthenticated network attack with high availability impact and zero confidentiality or integrity consequence. Real-world risk is tempered by SiYuan's typical deployment profile: as a personal note-taking tool it is commonly bound to localhost (default port 6806), meaning most installations are not internet-exposed. Users who have configured SiYuan for remote access, run it in server/team mode, or exposed it behind a reverse proxy without IP restrictions face genuine remote exploitation risk. No KEV listing and no confirmed POC reduce urgency for air-gapped or localhost-only deployments. EPSS data is not available in the provided input. There are no conflicting signals - CVSS vector, CWE, and description are internally consistent. |
| Exploit ScenarioDerived | An attacker identifies a SiYuan instance accessible over the network and sends a continuous stream of HTTP POST requests to /api/system/uiproc, each carrying a distinct process identifier string. Since the server retains every submitted identifier without eviction or quota, process memory grows unboundedly until the host OOM-kills the SiYuan process or performance degrades to the point of service unavailability. The attack requires no authentication, no exploit framework, and can be executed with a simple loop using curl or any HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Unauthenticated remote memory exhaustion in SiYuan before v3.8.2 allows any network-reachable attacker to degrade or crash the service by flooding the /api/system/uiproc endpoint with unique process identifiers. The endpoint retains each submitted identifier in memory without size bounds, rate limiting, or authentication checks, making the attack trivially automatable. No public exploit code or KEV status is confirmed at time of analysis, but the simplicity of exploitation via repeated HTTP requests requires no special tooling.
RemediationAI
Upgrade SiYuan to v3.8.2 or later, which resolves the unbounded identifier accumulation in /api/system/uiproc. The fix is documented in GHSA-wv96-wmf5-xvj2. If immediate upgrade is not possible, bind the SiYuan API listener to localhost (127.0.0.1) rather than a public interface, preventing remote attackers from reaching the vulnerable endpoint - note this disables remote/multi-device access. Alternatively, deploy a reverse proxy or firewall rule to restrict access to the API port (default TCP 6806) to trusted source IPs only, preserving remote access for authorized users while blocking untrusted callers. Neither workaround eliminates the root cause; patching to v3.8.2 is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SiYuan is an open-source local-first personal knowledge management application (CPE: cpe:2.3:a:siyuan-note:siyuan). Its backend exposes a REST-style API, including the /api/system/uiproc endpoint intended to register or track UI process identifiers. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the endpoint accepts attacker-controlled identifier values and accumulates them in process memory indefinitely with no eviction, quota, or request-rate enforcement. Because the endpoint lacks authentication, no session or credential is required to trigger accumulation. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H confirms a network-accessible, low-complexity, unauthenticated path with high availability impact.
Know when Siyuan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated network endpoint, no interaction or complexity required; impact is availability-only via memory exhaustion, no C or I consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.
Technical POC Analysis
Bug class: CWE-770, allocation of resources without limits or throttling.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
SiYuan versions before 3.8.2 are vulnerable to unauthenticated remote denial-of-service attacks that exhaust server memory and crash the service. Any internet-connected SiYuan instance can be targeted without credentials by flooding a single API endpoint, creating unplanned downtime that blocks access for all users. Organizations relying on SiYuan for collaborative note-taking and knowledge management face service unavailability and potential data access disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict /api/system/uiproc endpoint to trusted internal networks only via firewall or WAF; (2) Implement strict per-IP rate limiting and maximum request body size enforcement; (3) Deploy reverse proxy with authentication requirements before SiYuan processes requests; (4) Enable memory monitoring with automated service restart on threshold breach; (5) Segment SiYuan from internet-facing networks pending upgrade to v3.8.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
SQL injection in SiYuan's fullTextSearchAssetContent endpoint lets unauthenticated attackers and holders of publish Role
Stored cross-site scripting in SiYuan personal knowledge management before 3.7.0 lets an attacker with write access to a
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
Stored cross-site scripting in SiYuan's attribute-view (database) cell renderer, affecting all versions prior to 3.7.0,
SQL injection in SiYuan personal knowledge-management software (all versions before v3.7.3) lets attackers inject arbitr
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Remote code execution in SiYuan note-taking application (before v3.6.1) allows any malicious Bazaar marketplace package
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Exploit-DB