High severity7.5NVD Advisory· Published Sep 4, 2026· Updated Sep 10, 2026

CVE-2026-85581

Description

SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Siyuan Note/Siyuanllm-fuzzy
Range: <3.8.2

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-wv96-wmf5-xvj2nvd
www.vulncheck.com/advisories/siyuan-before-3.8.2-denial-of-service-via-unauthenticated-ui-process-registrationnvd

News mentions

Siyuan Note: Batch of 13 Vulnerabilities Includes Critical XSS and DoS Flaws
Vypr Intelligence · Sep 5, 2026

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000