CVE-2026-85585: Uncontrolled Resource Consumption in siyuan-note siyuan

CVE-2026-85585 describes an unbounded resource consumption vulnerability in SiYuan note-taking software before version 3.8.2. The issue resides in the request-concurrency middleware, which retains mutex entries for every unique request path without any eviction mechanism. An unauthenticated attacker can exploit this by sending a large number of unique request paths, leading to permanent growth in process memory and synchronization overhead. This can degrade the application's availability by exhausting resources.

The vulnerability allows unauthenticated attackers to cause a denial-of-service condition by exhausting memory and synchronization resources through numerous unique requests. This degrades the availability of the SiYuan service, potentially impacting legitimate users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.8.2, upgrading to version 3.8.2 or later may address the issue if the vendor has released a fix. Until an official fix is confirmed, consider implementing network-level rate limiting or filtering to reduce the impact of repeated unique requests.