EUVD-2026-71007
GHSA-f2hr-7qxv-2pwm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-accessible SiYuan publish-service
-
DeliverySend repeated HTTP Basic Auth requests with unique invalid usernames
-
ExploitPer-username throttle state accumulates in unbounded in-memory map
-
ExecutionHeap memory exhausted
-
ImpactPublish-service degraded or crashed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The SiYuan publish-service must be enabled and network-reachable by the attacker; this service is not a default-on component in all deployment configurations, so instances where publish-service is disabled or firewalled off are not directly exposed. No authentication is required - the vulnerability exists in the pre-authentication throttle layer, meaning any HTTP client that can reach the publish-service endpoint can trigger it. Limiting factors include: the publish-service must be running and accessible (non-default for purely local/personal deployments), and the attack requires sustained request volume to exhaust memory, which may be detectable via access logs before service impact becomes severe. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a remotely exploitable, low-complexity attack requiring no privileges or user interaction - the most favorable attack surface for an adversary. The sole impact is availability (VA:H), with confidentiality and integrity unaffected, which appropriately constrains the threat model. No EPSS score was included in the input data, and neither a CISA KEV listing nor a public PoC has been identified, suggesting opportunistic mass exploitation has not yet materialized. Nonetheless, even a mid-sized municipal IT team in tczew running SiYuan's publish-service on an internet-facing host should treat this as urgent, because the attack is trivially scriptable - a simple loop generating unique username strings is sufficient - and the fix (upgrade to v3.8.2) is available with no reported breaking changes. The primary limiting factor is deployment context: SiYuan instances where the publish-service is disabled or restricted behind a firewall are not exposed. |
| Exploit ScenarioDerived | An unauthenticated attacker scripts a loop that sends HTTP Basic Auth requests to the SiYuan publish-service endpoint, each carrying a unique randomly generated username string. With each request, the throttle inserts a new entry into the unbounded in-memory map; over thousands of requests the map grows to exhaust available heap memory, causing the publish-service process to slow, become unresponsive, or crash. No public PoC has been identified, but the attack requires only standard HTTP tooling and is trivially automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Memory exhaustion denial-of-service in SiYuan's publish-service Basic Auth throttle allows unauthenticated remote attackers to crash or degrade the service by submitting authentication requests with an unbounded number of unique invalid usernames. Because the throttle tracks per-username failure state in memory with no capacity limit or eviction policy, the in-memory tracking structure grows without bound until the process exhausts available heap. All SiYuan versions prior to v3.8.2 are affected; no active exploitation has been identified at time of analysis.
RemediationAI
Upgrade SiYuan to v3.8.2 or later, which resolves the unbounded memory accumulation in the publish-service Basic Auth throttle; the fix is documented in GitHub Security Advisory GHSA-2x7j-p79w-7744. Prior to patching, operators should restrict network access to the publish-service endpoint using a host-based firewall or upstream reverse proxy configured to permit only trusted IP ranges, eliminating the unauthenticated network vector entirely. If the publish-service feature is not required, disabling it removes all exposure with no impact on core SiYuan functionality. Applying per-source-IP rate limiting at a reverse proxy or WAF layer (e.g., nginx limit_req_zone) reduces attack throughput but does not fully mitigate the flaw if an attacker rotates source IPs; this workaround should be treated as a temporary measure, not a substitute for upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SiYuan is an open-source personal knowledge management and note-taking application (CPE: cpe:2.3:a:siyuan-note:siyuan). Its publish-service exposes HTTP endpoints protected by HTTP Basic Authentication, and implements a brute-force throttle that records per-username failure counts to limit credential-stuffing attempts. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the data structure used to track these per-username counters is keyed on attacker-supplied username strings with no upper bound on the number of distinct keys it will store, no time-to-live or idle eviction, and no maximum-size enforcement. Because the key space is attacker-controlled and unbounded, an adversary can trivially inflate the map indefinitely, consuming heap memory and increasing synchronization overhead on each subsequent auth check.
Know when Siyuan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated network attack requiring no complexity; sole impact is availability via memory exhaustion with no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.
Technical POC Analysis
Vulnerability class: CWE-770, Allocation of Resources Without Limits or Throttling.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
SiYuan's publish-service is vulnerable to remote denial-of-service attacks that crash or degrade the service without requiring authentication. Attackers exploit a memory-exhaustion flaw in the Basic Auth throttle by submitting requests with unique invalid usernames, causing unbounded heap growth and service unavailability in all versions prior to v3.8.2.
Apply vendor patch: SiYuan v3.8.2
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
SQL injection in SiYuan's fullTextSearchAssetContent endpoint lets unauthenticated attackers and holders of publish Role
Stored cross-site scripting in SiYuan personal knowledge management before 3.7.0 lets an attacker with write access to a
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
Stored cross-site scripting in SiYuan's attribute-view (database) cell renderer, affecting all versions prior to 3.7.0,
SQL injection in SiYuan personal knowledge-management software (all versions before v3.7.3) lets attackers inject arbitr
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Remote code execution in SiYuan note-taking application (before v3.6.1) allows any malicious Bazaar marketplace package
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Exploit-DB