Is CVE-2026-85584 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85584?

CVE-2026-85584 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-85584

Description

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.