What is GHSA-gm2w-r3g5-frq5?

GHSA-gm2w-r3g5-frq5 is a security advisory published by GitHub Security Advisories with High severity. SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish...

Which CVE IDs does GHSA-gm2w-r3g5-frq5 cover?

GHSA-gm2w-r3g5-frq5 covers the following CVE IDs: CVE-2026-85582. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gm2w-r3g5-frq5?

GHSA-gm2w-r3g5-frq5 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-gm2w-r3g5-frq5HighCVSS 6.5

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish...

Vendor

GitHub Security Advisories

Published

September 4, 2026

Last Modified

September 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-85582 →

📋 Description

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite process memory growth and denial of service.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f4vj-ppp2-5hg4
https://nvd.nist.gov/vuln/detail/CVE-2026-85582
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-unbounded-session-creation-via-basic-auth
https://github.com/advisories/GHSA-gm2w-r3g5-frq5