Authenticated session accounts remain permanently resident in memory when an attacker repeatedly supplies valid Basic Auth credentials to the publish-service endpoint. The session objects are created without expiration or capacity limits, permitting indefinite growth of persistent session entries and causing the overall process memory footprint to expand until resource exhaustion and eventual failure of the SiYuan service.

All Siyuan Note instances running the Siyuan application prior to version 3.8.2 are affected. Attackers require valid user credentials but no elevated privileges; any user who can authenticate can trigger the vulnerability.

The vulnerability carries a CVSS v3.1 score of 7.1, indicating a moderate to high severity. EPSS data is not available, but the creation of unbounded sessions directly leads to a denial of service. Since the issue is not listed in CISA KEV, no known public exploits are recorded yet, yet attackers could duplicate the behavior manually by sending repeated authenticated requests.