Description

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite process memory growth and denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T12:17:20.190Z",
  "pubdate": "2026-09-04T12:17:20.190Z",
  "executiveSummary": "SiYuan versions prior to v3.8.2 are susceptible to a memory exhaustion vulnerability within the publish-service Basic Auth handler, categorized as an improper resource management flaw.\nThis vulnerability stems from the implementation of an unbounded session creation mechanism that lacks expiration logic or capacity constraints for authenticated sessions.\nThe primary impact is a Denial of Service (DoS) resulting from indefinite heap memory growth as persistent session objects accumulate within the application process.\nAn authenticated attacker can exploit this condition by repeatedly initiating authentication sequences, forcing the server to allocate resources for each session without reclamation.\nThis vulnerability requires valid user credentials to initiate the session creation process, meaning the attack vector is restricted to authenticated users.\nRisk implications include system instability, potential service crashes, and overall degradation of application availability due to critical resource depletion.",
  "technicalDetails": "The vulnerability resides in the publish-service component of SiYuan, specifically within the Basic Auth handler responsible for managing user sessions.\nRoot cause analysis reveals a failure to implement lifecycle management for session objects. When an authenticated user triggers a session, the system registers a new entry in its internal memory structure. Because the application lacks a garbage collection policy, session timeout mechanism, or a defined maximum session capacity, these objects persist indefinitely in the process memory space.\nThe attack flow commences when an attacker, possessing valid credentials, repeatedly performs authentication requests. Each successful request compels the Basic Auth handler to instantiate a new session entry. Because the application logic does not verify existing sessions or apply an 'evict-if-full' policy, every request adds a discrete memory footprint to the server's heap.\nAs the number of unauthorized or redundant sessions grows, the process's resident set size (RSS) increases proportionally. Over time, this leads to significant memory pressure, eventual heap exhaustion, and catastrophic failure of the service, effectively inducing a Denial of Service condition.\nThe vulnerability is limited to the SiYuan publish-service; however, since this service is integrated into the core application, the memory consumption directly affects the stability of the entire SiYuan process.\nExploitation is straightforward and does not require complex payloads or elevated system privileges beyond those of an authenticated user. By scripting repetitive HTTP Basic Authentication requests, an attacker can rapidly overwhelm available system memory, regardless of the hardware resources allocated to the instance.\nPost-exploitation impact manifests as a service hang or crash, necessitating a manual restart of the SiYuan application to clear the corrupted memory state. Given the lack of session expiry, there is no automatic recovery path for the system once the memory threshold is breached."
}