CVE-2026-85584
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Sep 04, 2026
Vendor
unknown
Description
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.