CVE-2025-68272 - CVE House

Back to Database

Status published High CVE-2025-68272

Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding

7.5 CVSS

Vulnerability Description

Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). This causes a "JavaScript heap out of memory" error due to unbounded in-memory storage of request objects. Version 2.19.0 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68272

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from SignalK

View All →

Signal K Server Vulnerable to Access Request Spoofing

Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package

Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Affected Vendor

SignalK

View all reports →

Affected Software

signalk-server

Vulnerable Versions:

< 2.19.0

Timeline

Official Publish: January 1st, 2026

Last Modified: January 2nd, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400 CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1190 Exploit Public-Facing Application

T1562 Impair Defenses

Defense Evasion

T1046 Network Service Discovery