Description

SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T12:17:20.050Z",
  "pubdate": "2026-09-04T12:17:20.050Z",
  "executiveSummary": "SiYuan versions prior to 3.8.2 are susceptible to a Denial of Service (DoS) vulnerability located within the /api/system/uiproc endpoint.\nThis vulnerability is classified as a resource exhaustion flaw where the application fails to implement bounds checking or authentication on incoming process identifier data.\nAn unauthenticated, remote attacker can leverage this endpoint to inject arbitrary process identifiers into the system's memory-resident tracking structures.\nBy continuously submitting unique identifiers, the attacker can force the application to consume unbounded amounts of system memory, eventually leading to process instability, service degradation, or a complete crash of the SiYuan service.\nThe primary risk implication is the loss of availability for the application, as the attack requires minimal effort and can be executed repeatedly from any network location that reaches the management API.\nThe vulnerability highlights a lack of proper input validation and resource management policies within the system's process handling architecture, allowing for trivial exploitation by unauthorized entities.",
  "technicalDetails": "The vulnerability resides in the /api/system/uiproc endpoint, which is designed to track or manage process identifiers (PIDs) but lacks necessary security controls.\nThe root cause is the combination of an unauthenticated access model and the absence of size-limiting mechanisms or rate-limiting on the data payload processed by the endpoint.\nWhen a request is received, the application registers the provided process identifier in an internal data structure intended to monitor or manage active system processes.\nBecause the application does not validate the existence or legitimacy of the provided identifiers, nor does it enforce a maximum capacity on the number of stored identifiers, the internal memory structures can grow indefinitely.\nAn attacker can automate the exploitation process by sending a high frequency of HTTP POST requests, each containing unique, arbitrary strings as process identifiers.\nEach request triggers a memory allocation event as the application adds the new identifier to its internal registry. Given the lack of a cleanup mechanism or a maximum threshold for these entries, the heap memory assigned to the SiYuan service process expands until the host environment exhausts available RAM or the application encounters an out-of-memory error.\nThe attack flow follows a straightforward pattern: 1) The attacker initiates an HTTP connection to the target /api/system/uiproc endpoint. 2) The attacker crafts a request payload containing a novel process identifier. 3) The backend receives the request and, due to the missing authentication check, accepts the input without verification. 4) The identifier is committed to the application's memory pool. 5) The attacker repeats steps 2-4 rapidly to induce rapid resource depletion.\nThis behavior results in a state of exhaustion where the server's response time degrades exponentially, eventually resulting in total service failure, necessitating a manual restart of the application to recover system state.\nThe vulnerability affects all versions of SiYuan before 3.8.2. Since the endpoint is exposed at the API level, any network access to the application's management interface provides a direct vector for exploitation, regardless of user-level privileges."
}