CVE-2026-85581 — SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration
SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifie…
Published: 2026-09-04 · CVSS: 8.7 · CVSS 4.0
SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7