CVE-2026-85582

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2

Description The publish-service Basic Auth handler contains an unbounded session creation issue. Authenticated attackers can repeatedly authenticate using valid credentials to generate persistent session entries that lack expiry or capacity limits. This leads to continuous process memory growth, resulting in a denial of service.

Recommendations Update to version 3.8.2 or later.