CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to 3.8.2 are vulnerable to a denial of service attack due to a flaw in the publish-service Basic Auth throttle, which allows attackers to exploit the failed-attempt state storage mechanism using arbitrary usernames. This vulnerability can lead to service degradation by exhausting memory and increasing synchronization overhead through repeated invalid authentication requests. Organizations using affected versions should prioritize patching to mitigate potential disruptions to service availability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.