CVE-2026-85585 SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency
Unauthenticated attackers can cause denial of service in SiYuan by sending numerous unique request paths to exhaust memory and synchronization resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85585?
CVE-2026-85585 is a high-severity denial of service vulnerability in siyuan-note siyuan, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory and synchronization overhead, degrading availability.
Weakness: CWE-400
Which versions are affected by CVE-2026-85585?
How do I fix CVE-2026-85585?
No fix has been published for CVE-2026-85585 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-85585 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85585 exists.
Sources
Also known as GHSA-p59v-3q54-qq55, GHSA-w2pg-pc8x-qj83.