PT-2026-1016 · Unknown · Signal K Server

Published 2026-01-01 · Updated 2026-01-06 · CVE-2025-68272

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0

Description Signal K Server is a server application used on boats. A Denial of Service (DoS) condition can occur in versions prior to 2.19.0. An unauthenticated attacker can crash the server by sending a large number of requests to the access request endpoint, /signalk/v1/access/requests. This results in a "JavaScript heap out of memory" error because the server stores request objects in memory without limits.

Recommendations Update to version 2.19.0 or later.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2025-68272

GHSA-7RQC-FF8M-7J23

Affected Products

Signal K Server

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68272.json · Exploit
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-7rqc-ff8m-7j23 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68272 · Security Note
• https://osv.dev/vulnerability/GHSA-7rqc-ff8m-7j23 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68272 · Vendor Advisory
• https://github.com/SignalK/signalk-server · Note
• https://github.com/SignalK/signalk-server/releases/tag/v2.19.0 · Note
• https://github.com/SignalK/signalk-server/commit/55e3574d8266fbc0ed8e453ad4557073541566f5 · Note
• https://twitter.com/CVEnew/status/2006861496274317809 · Twitter Post
• https://t.me/cveNotify/147450 · Telegram Post
• https://t.me/CVEtracker/41185 · Telegram Post
• https://twitter.com/cracbot/status/2008493796791890215 · Twitter Post
• https://twitter.com/pulsepatchio/status/2007101656815509822 · Twitter Post
• https://t.me/cveNotify/147885 · Telegram Post
• https://t.me/cveNotify/147447 · Telegram Post