{"id":"EUVD-2025-206139","enisaUuid":"13f43770-5852-35eb-911c-24bb2f00d99d","description":"Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). This causes a \"JavaScript heap out of memory\" error due to unbounded in-memory storage of request objects. Version 2.19.0 fixes the issue.","datePublished":"Jan 1, 2026, 6:08:06 PM","dateUpdated":"Jan 2, 2026, 6:55:16 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-7rqc-ff8m-7j23\nhttps://github.com/SignalK/signalk-server/releases/tag/v2.19.0\n","aliases":"CVE-2025-68272\nGHSA-7rqc-ff8m-7j23\n","assigner":"GitHub_M","epss":0.56,"enisaIdProduct":[{"id":"e297ee80-9270-31d4-8d4e-baf63bd5eee7","product":{"name":"signalk-server","vendor":{"name":"SignalK"}},"product_version":"\u003c 2.19.0"}],"enisaIdVendor":[{"id":"e4906cd8-5b56-37e3-a057-ee4df21fef09","vendor":{"name":"SignalK"}}],"enisaIdVulnerability":[{"id":"0499bef5-c707-35a3-9e37-9fdbde184a4d","vulnerability":{"id":"CVE-2025-68272","description":"Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). This causes a \"JavaScript heap out of memory\" error due to unbounded in-memory storage of request objects. Version 2.19.0 fixes the issue.","datePublished":"Jan 1, 2026, 6:08:06 PM","dateUpdated":"Jan 2, 2026, 6:55:16 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-7rqc-ff8m-7j23\nhttps://github.com/SignalK/signalk-server/releases/tag/v2.19.0\n","enisa_id":"EUVD-2025-206139\n","assigner":"GitHub_M","epss":0.56,"dataProcessed":"Nov 8, 2026, 7:13:21 AM","vulnerabilityProduct":[{"id":"eece946b-6a5e-375e-a67a-ebc60a8a08f8","product":{"name":"signalk-server","vendor":{"name":"SignalK"}},"product_version":"\u003c 2.19.0"}],"vulnerabilityVendor":[{"id":"ef60b614-1b95-3eae-a4d7-72091d025c4d","vendor":{"name":"SignalK"}}]}},{"id":"171bbebf-e6a5-3d54-8ad2-8255636f8563","vulnerability":{"id":"GHSA-7rqc-ff8m-7j23","description":"Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding","datePublished":"Jan 2, 2026, 3:20:05 PM","dateUpdated":"Jan 2, 2026, 3:20:05 PM","baseScore":0.0,"references":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-7rqc-ff8m-7j23\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68272\nhttps://github.com/SignalK/signalk-server/commit/55e3574d8266fbc0ed8e453ad4557073541566f5\nhttps://github.com/SignalK/signalk-server\nhttps://github.com/SignalK/signalk-server/releases/tag/v2.19.0\n","enisa_id":"EUVD-2025-206139\n","aliases":"GHSA-7rqc-ff8m-7j23\nCVE-2025-68272\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:54:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}