High severity7.5NVD Advisory· Published Sep 4, 2026· Updated Sep 8, 2026

CVE-2026-85585

Description

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory and synchronization overhead, degrading availability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Siyuan Note/Siyuanllm-fuzzy
Range: <3.8.2

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-p59v-3q54-qq55nvd
www.vulncheck.com/advisories/siyuan-before-3.8.2-unbounded-memory-consumption-via-controlconcurrencynvd

News mentions

Siyuan Note: Batch of 13 Vulnerabilities Includes Critical XSS and DoS Flaws
Vypr Intelligence · Sep 5, 2026

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000