SiYuan CVE-2026-85582

Exploitation requires a valid SiYuan user account (CVSS PR:L) and network-level access to the SiYuan publish-service HTTP endpoint. The flaw is triggered exclusively by the Basic Auth handler in the publish-service component; SiYuan instances that do not expose the publish service are not affected. No elevated privileges, special operating-system configuration, or non-default application settings are required beyond possessing authenticated credentials. Limiting factors: unauthenticated attackers cannot exploit this vulnerability; sustained connectivity and repeated requests are needed to accumulate enough session entries to exhaust memory at scale; and single-user local deployments with no external network exposure face negligible risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) accurately captures the attack profile: network-reachable, low complexity, requiring only authenticated access, with high availability impact and no confidentiality or integrity consequences. Even a mid-sized municipal IT team in kalisz running SiYuan as a shared knowledge base should treat this as a meaningful but bounded risk - the DoS is real and repeatable, yet the credential requirement limits the threat primarily to insider abuse, compromised accounts, or deployments where self-registration is unrestricted. The vulnerability is not listed in CISA KEV, no public exploit code is known, and EPSS data is absent from available intelligence, making this a medium operational priority: worth patching promptly but not an emergency for environments with tight access control.

An attacker holding a valid SiYuan account - or operating a script under stolen credentials - sends a sustained stream of HTTP requests bearing Basic Auth credentials to the publish-service endpoint. Each request causes the server to allocate a new session entry that is never freed, driving heap memory steadily upward until the host's RAM is exhausted and the SiYuan process crashes or becomes unresponsive. No public exploit code is known, but the technique requires only a standard HTTP client and valid credentials, making independent reproduction trivial.