Lplum

**Name of the Vulnerable Software and Affected Versions** Eclipse KUKSA Databroker version 0.6.1 **Description** The `kuksa.val.v2.VAL/PublishValue` gRPC handler fails to validate the existence of the optional `data point` field in `PublishValueRequest`. If a request includes a valid `signal id` but omits `data point`, the server executes the `unwrap()` function on `request.data point`, causing a panic in the Tokio worker thread. This condition can be triggered by any client possessing a valid JWT token. While the panic cancels the specific gRPC call, the Databroker process continues to run and remains available for other requests. **Recommendations** As a temporary mitigation, restrict the use of the `data point` field in the `kuksa.val.v2.VAL/PublishValue` endpoint to ensure it is always provided when a `signal id` is present. At the moment, there is no information about a newer version that contains a fix for this vulnerability.