CVE-2026-85581CWE-770denial-of-service

CVE-2026-85581

High · published September 4, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00575 · 46.7th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-04T16:17Z
References (2)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wv96-wmf5-xvj2 · [email protected]https://www.vulncheck.com/advisories/siyuan-before-3.8.2-denial-of-service-via-unauthenticated-ui-process-registration · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 11:29Z
    SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration
    cvelistv5