Denial of Service Vulnerability in Signal K Server - Signal K
CVE-2025-68272

7.5HIGH

Key Information:

Vendor

Signalk

Status
Signalk-server
Vendor
CVE Published:
1 January 2026

What is CVE-2025-68272?

The Signal K Server, which operates as a central hub for boat data management, is susceptible to a Denial of Service vulnerability in versions released prior to 2.19.0. This flaw allows unauthenticated attackers to exploit the server by sending an excessive number of access request messages to the endpoint (/signalk/v1/access/requests). Such an attack can lead to the server experiencing a 'JavaScript heap out of memory' error, resulting in a complete crash of the application. The vulnerability has been addressed in version 2.19.0, which alleviates the issue by improving how request objects are managed in memory.

Affected Version(s)

signalk-server < 2.19.0

References

https://github.com/SignalK/signalk-server/security/adviso...
x_refsource_CONFIRM
https://github.com/SignalK/signalk-server/releases/tag/v2...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.