In Eclipse KUKSA Databroker 0.6.1 the PublishValue gRPC handler does not verify the optional data_point field. When a request contains a valid signal_id but omits data_point, the server unwraps the field directly and triggers a panic in a Tokio worker thread. This panic cancels the individual gRPC call but leaves the overall Databroker process alive, resulting in a partial denial-of-service for the affected call. The flaw requires a client to possess a valid JWT token; unauthenticated or invalid‑token requests are rejected before reaching the vulnerable code path.

The vulnerable component is Eclipse KUKSA Databroker provided by the Eclipse Foundation, specifically version 0.6.1. No other affected versions are listed.

The CVSS score of 4.3 indicates low severity, and the EPSS score of less than 1% denotes a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and today it does not lead to full process crash or code execution. Likely attack would be performed over the network by an authenticated client that can forge a valid JWT, derived from the description. Overall risk is considered low, but repeated induced panics could lead to degraded service availability.