EUVD-2026-71008
GHSA-w2pg-pc8x-qj83
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-accessible SiYuan instance
-
DeliverySend high-volume HTTP requests with unique path strings
-
ExploitMutex map grows unbounded in memory
-
ExecutionProcess heap exhaustion and GC pressure increase
-
PersistSiYuan becomes unresponsive
-
ImpactDenial of service achieved
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions required beyond network reachability of SiYuan's HTTP listener (default port 6806). Exploitation is unauthenticated (PR:N) and requires no user interaction. The attack is most effective against internet-exposed or LAN-accessible instances without an authenticating reverse proxy. Limiting factors: SiYuan is most commonly deployed as a local single-user application bound to localhost; instances not exposed beyond localhost are not reachable by remote attackers. Deployments behind authenticated reverse proxies require attacker credentials to reach the vulnerable middleware layer. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scores 8.7, accurately reflecting unauthenticated network-reachable DoS with no prerequisite conditions beyond HTTP access. The impact triad is C:N/I:N/A:H - confidentiality and integrity are not affected; the sole consequence is availability loss. SiYuan is typically deployed as a single-user or small-team server exposed on a local network or behind a reverse proxy; internet-facing instances without authentication enforcement are at highest risk. No CISA KEV listing and no public exploit code have been identified, and EPSS data is not provided, reducing operational urgency somewhat. That said, the attack is trivially automatable - no authentication, no complex state, just HTTP GET floods with varied paths - which elevates practical severity for exposed deployments. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to a SiYuan instance sends a high-volume flood of HTTP GET requests, each with a randomly generated path segment (e.g., /api/block/<uuid>). Each unique path creates a permanent mutex entry in the concurrency-control map; after thousands of such requests the Go process heap grows continuously, lock-contention on the global map increases, and SiYuan becomes unresponsive or crashes, denying service to all legitimate users. No exploit code or proof-of-concept has been publicly identified at time of analysis - the attack is mechanically trivial to implement from the vulnerability description alone. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Unbounded memory consumption in SiYuan's request-concurrency middleware allows unauthenticated remote attackers to permanently exhaust process memory by flooding the application with unique request paths. The root cause is a mutex-entry map that grows without bound - each distinct URL path creates a new mutex entry that is never evicted, causing memory and synchronization overhead to accumulate indefinitely. All SiYuan deployments prior to v3.8.2 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Upgrade SiYuan to v3.8.2 or later, which introduces eviction logic for the request-concurrency mutex map and resolves the unbounded growth. The fix version is confirmed by the vendor advisory (GHSA-p59v-3q54-qq55). For operators unable to upgrade immediately, restrict HTTP access to SiYuan's listening port to trusted IP ranges only (e.g., via firewall rules or reverse-proxy allow-lists), as the attack requires direct network access to the service endpoint. Placing SiYuan behind an authenticating reverse proxy (e.g., nginx with HTTP Basic Auth) will also break the unauthenticated exploitation path, though this introduces credential management overhead. Rate-limiting unique path requests at the reverse-proxy or WAF layer provides an additional compensating control but does not eliminate the underlying unbounded-map defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SiYuan (CPE: cpe:2.3:a:siyuan-note:siyuan) is a self-hosted, Electron/Go-based personal knowledge-management system. Its HTTP middleware implements per-path request concurrency control using a mutex map keyed on the request path string. The flaw (CWE-400: Uncontrolled Resource Consumption) arises because this map lacks any eviction, TTL, or size-bounding mechanism: each unique path string permanently occupies a map entry and its associated sync.Mutex struct. An attacker abusing URL path entropy (e.g., appending random query parameters or path segments) causes the map to grow without limit, eventually triggering Go runtime GC pressure, lock-contention on the map itself, and ultimately process crash or severe latency degradation.
Know when Siyuan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated network attack with no complexity or interaction; sole impact is availability loss, no C or I effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory and synchronization overhead, degrading availability.
Technical POC Analysis
CWE-400 - uncontrolled resource consumption.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
SiYuan's request-concurrency middleware is vulnerable to unauthenticated remote denial-of-service attacks that exhaust application memory through unique request-path flooding. All deployments prior to v3.8.2 face service disruption risk with no vendor patch currently available, potentially blocking team access to critical organizational knowledge and notes.
Implement network-level rate limiting (requests/IP/minute), enforce maximum unique request-path counts per session, apply WAF rules to detect abuse patterns, restrict application memory via container/OS limits, and require authentication or VPN access for all external connections. Monitor process memory continuously and alert on anomalous consumption. Restrict SiYuan to internal networks or VPN access only if feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
SQL injection in SiYuan's fullTextSearchAssetContent endpoint lets unauthenticated attackers and holders of publish Role
Stored cross-site scripting in SiYuan personal knowledge management before 3.7.0 lets an attacker with write access to a
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
Stored cross-site scripting in SiYuan's attribute-view (database) cell renderer, affecting all versions prior to 3.7.0,
SQL injection in SiYuan personal knowledge-management software (all versions before v3.7.3) lets attackers inject arbitr
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Remote code execution in SiYuan note-taking application (before v3.6.1) allows any malicious Bazaar marketplace package
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Exploit-DB