Description

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory and synchronization overhead, degrading availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T12:17:20.593Z",
  "pubdate": "2026-09-04T12:17:20.593Z",
  "executiveSummary": "SiYuan versions prior to 3.8.2 are susceptible to an unbounded resource consumption vulnerability originating from the application's request-concurrency middleware.\nThis flaw allows unauthenticated remote attackers to induce a state of denial-of-service by exhausting system memory and increasing synchronization overhead.\nThe vulnerability exists because the middleware tracks mutex entries for unique request paths without implementing an eviction policy, cache expiration, or memory thresholding.\nBy continuously submitting requests with unique, arbitrary paths, an attacker can cause the process to retain an ever-growing set of objects in memory.\nThis behavior leads to significant degradation of service availability and eventual process termination due to resource exhaustion.\nThe vulnerability requires no authentication and can be exploited over the network, posing a critical availability risk to instances exposed to untrusted environments.",
  "technicalDetails": "The vulnerability resides in the request-concurrency middleware of SiYuan, which is responsible for managing concurrent access to specific resources based on request paths.\nThe root cause is a lack of resource management within the concurrency control logic, specifically the indefinite retention of mutex objects associated with unique request paths.\nIn the affected versions, every unique request path encountered by the application triggers the creation of a dedicated mutex entry within the middleware’s internal tracking structure.\nBecause there is no mechanism for cache eviction, such as Least Recently Used (LRU) eviction or Time-To-Live (TTL) expiration, these objects remain stored in the heap indefinitely.\nAn attacker can exploit this by sending a high volume of requests, each targeting a unique, previously unseen path (e.g., using random query strings or path parameters).\nEach request forces the application to allocate memory for the new mutex object and metadata required for concurrency control.\nAs the number of entries grows, the system incurs two primary performance penalties: an linear increase in process memory usage and a rise in synchronization overhead during the lookup and management of the sprawling internal map or table of mutexes.\nThe attack flow proceeds as follows: 1) The attacker initiates a series of HTTP requests with varying, unique URL paths. 2) The middleware receives these requests and identifies them as needing concurrency control. 3) Finding no existing entry for the unique path, the middleware instantiates a new mutex. 4) The object is stored in persistent application memory. 5) This cycle repeats until system memory limits are reached, resulting in degraded application performance, high CPU utilization during synchronization operations, and potential process instability or crashes.\nBecause the middleware does not enforce limits on the number of concurrent paths or the total size of the tracking structure, it is effectively an open-ended memory leak vector triggered via malicious input.\nThis vulnerability is particularly impactful as it requires no prior authentication or privileged access to the application, making it accessible from any network endpoint capable of reaching the SiYuan service."
}