SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory and synchronization overhead, degrading availability.

SiYuan versions before v3.8.2 contain an unbounded resource consumption vulnerability in the request-concurrency middleware. The middleware retains mutex entries for every unique request path without any eviction mechanism. Unauthenticated attackers can exploit this by sending numerous unique request paths to the application. This causes permanent increases in process memory usage and synchronization overhead. The vulnerability degrades service availability, effectively functioning as a denial-of-service attack vector. No authentication is required to exploit this vulnerability, making it accessible to any remote attacker. The issue has been addressed in SiYuan v3.8.2. The vulnerability is tracked as CVE-2026-85585 and has been assigned a high criticality rating. Details are available via GitHub Security Advisories and VulnCheck.