Description

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T12:17:20.463Z",
  "pubdate": "2026-09-04T12:17:20.463Z",
  "executiveSummary": "SiYuan versions prior to v3.8.2 are susceptible to a Denial of Service (DoS) vulnerability located within the publish-service Basic Authentication throttle mechanism.\nThe vulnerability arises from improper management of failed authentication attempts, specifically the failure to implement capacity constraints or eviction policies for state storage.\nUnauthenticated attackers can leverage this flaw by injecting a high volume of requests featuring unique, randomized usernames. This triggers an uncontrolled expansion of the internal tracking map, leading to heap memory exhaustion and increased synchronization overhead.\nThe impact is a degradation or total collapse of service availability for legitimate users. No elevated privileges are required for exploitation, as the flaw resides within an unauthenticated endpoint. This vulnerability poses a significant risk to service stability in exposed environments, necessitating an urgent update to v3.8.2 or later to enforce proper rate-limiting constraints.",
  "technicalDetails": "The core of this vulnerability lies in the implementation of the Basic Auth throttle component within the SiYuan publish-service. When the service receives an authentication request, it attempts to track failed login attempts to mitigate brute-force attacks.\nThe flaw manifests because the state management mechanism for these failed attempts utilizes an unbounded data structure (likely a hash map or similar in-memory store) that uses the attacker-provided username as the key. Because the system does not validate or limit the number of unique entries in this map, nor does it implement an LRU (Least Recently Used) or time-based eviction policy, an attacker can trivially inflate the size of this structure.\nAn unauthenticated attacker can execute a low-cost, high-impact DoS attack by scripting a series of HTTP requests to the affected authentication endpoint. By iterating through an infinite set of unique, invalid usernames, the attacker forces the application to allocate memory for each distinct entry. As the memory usage grows, the service encounters significant overhead related to memory management and garbage collection.\nFurthermore, because this data structure likely requires mutex locks or similar synchronization primitives to maintain thread safety during concurrent authentication attempts, the uncontrolled growth of the collection increases the contention on these locks. As the number of entries scales, the synchronization overhead leads to latency spikes, effectively stalling the publish-service and preventing legitimate authentication attempts.\nThe attack flow proceeds as follows: 1) The attacker identifies the exposed Basic Auth endpoint. 2) The attacker initiates a automated loop sending requests with arbitrary, unique strings as the username field. 3) The publish-service creates an entry in the tracking map for every unique string. 4) The heap space is progressively consumed, and synchronization contention increases significantly. 5) The service responsiveness degrades until it becomes unresponsive or crashes due to resource exhaustion.\nThis vulnerability is present in all SiYuan versions preceding v3.8.2 and is reachable remotely without any prerequisite authentication or elevated privileges. The exhaustion is persistent until the service is restarted, at which point the memory is cleared, though the service remains vulnerable to immediate re-exploitation."
}