https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:25:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-264786 EUVD-2026-264786 https://cve.radiocsirt.org/vuln/euvd-2026-264786 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68272 <p>Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). This causes a &#34;JavaScript heap out of memory&#34; error due to unbounded in-memory storage of request objects. Version 2.19.0 fixes the issue.</p> <p>Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). This causes a &#34;JavaScript heap out of memory&#34; error due to unbounded in-memory storage of request objects. Version 2.19.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-68272 https://cve.radiocsirt.org/vuln/ghsa-7rqc-ff8m-7j23 <p><strong>Affected:</strong> npm: signalk-server</p> <p>### Summary A Denial of Service (DoS) vulnerability allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). This causes a &#34;JavaScript heap out of memory&#34; error due to unbounded in-memory storage of request objects.</p> <p>### Details The vulnerability is caused by a lack of rate limiting and improper memory management for incoming access requests.</p> <p>**Vulnerable Code Analysis:** 1. **In-Memory Storage**: In `src/requestResponse.js`, requests are stored in a simple JavaScript object: ```javascript const requests = {} ``` 2. **Unbounded Growth**: The `createRequest` function adds new requests to this object without checking the current size or count of existing requests. 3. **Infrequent Pruning**: The `pruneRequests` function, which removes old requests, runs only once every **15 minutes** (`pruneIntervalRate`). 4. **No Rate Limiting**: The endpoint `/signalk/v1/access/requests` accepts POST requests from any client without any rate limiting or authentication (by design, as it&#39;s for initial access requests).</p> <p>**Exploit Scenario:** 1. An attacker sends a large number of POST requests (e.g., 20,000+) or requests with large payloads to `/signalk/v1/access/requests`. 2. The server stores every request in the `requests` object in the Node.js heap. 3. The heap memory usage spikes rapidly. 4. The Node.js process hits its memory limit (default ~1.5GB) and crashes with `FATAL ERROR: Ineffective…</p> <p><strong>Affected:</strong> npm: signalk-server</p> <p>### Summary A Denial of Service (DoS) vulnerability allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). This causes a &#34;JavaScript heap out of memory&#34; error due to unbounded in-memory storage of request objects.</p> <p>### Details The vulnerability is caused by a lack of rate limiting and improper memory management for incoming access requests.</p> <p>**Vulnerable Code Analysis:** 1. **In-Memory Storage**: In `src/requestResponse.js`, requests are stored in a simple JavaScript object: ```javascript const requests = {} ``` 2. **Unbounded Growth**: The `createRequest` function adds new requests to this object without checking the current size or count of existing requests. 3. **Infrequent Pruning**: The `pruneRequests` function, which removes old requests, runs only once every **15 minutes** (`pruneIntervalRate`). 4. **No Rate Limiting**: The endpoint `/signalk/v1/access/requests` accepts POST requests from any client without any rate limiting or authentication (by design, as it&#39;s for initial access requests).</p> <p>**Exploit Scenario:** 1. An attacker sends a large number of POST requests (e.g., 20,000+) or requests with large payloads to `/signalk/v1/access/requests`. 2. The server stores every request in the `requests` object in the Node.js heap. 3. The heap memory usage spikes rapidly. 4. The Node.js process hits its memory limit (default ~1.5GB) and crashes with `FATAL ERROR: Ineffective…</p> https://cve.radiocsirt.org/vuln/ghsa-7rqc-ff8m-7j23