CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...

CVE-2026-85584

SiYuan versions before v3.8.2 are affected by a denial of service vulnerability in the publish-service Basic Auth throttle . The throttle stores failed-attempt state keyed by attacker-controlled usernames without enforcing capacity limits or eviction policies, allowing unauthenticated attackers t...