CVE-2026-39320
Published: 21 April 2026
Summary
CVE-2026-39320 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Signalk Signal K Server. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 15.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates this ReDoS vulnerability by applying the patch in Signal K Server version 2.25.0 that fixes the unescaped regex metacharacters in WebSocket handling.
Information input validation on the 'context' parameter in WebSocket subscription requests prevents injection of malicious regex metacharacters that trigger catastrophic backtracking.
Denial-of-service protection implements mechanisms to limit resource exhaustion from ReDoS attacks, such as CPU spikes caused by regex evaluation on long string identifiers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The ReDoS vulnerability enables direct exploitation of the public-facing Signal K Server via a crafted WebSocket request, causing application-level resource exhaustion and unresponsiveness, which maps to Application or System Exploitation under Endpoint Denial of Service.
NVD Description
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting…
more
unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.
Deeper analysisAI
Signal K Server, a Node.js application that serves as a central data hub for boat instrumentation and networking, is affected by CVE-2026-39320 in versions prior to 2.25.0. The vulnerability is an unauthenticated Regular Expression Denial of Service (ReDoS) in the WebSocket subscription handling logic. Attackers can inject unescaped regex metacharacters into the `context` parameter of a stream subscription request, triggering catastrophic backtracking in the server's regex evaluation, particularly when processing long string identifiers such as the server's self UUID. This leads to a complete denial of service with CPU utilization spiking to 100%, rendering the server unresponsive. The issue is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (Inefficient Regular Expression Complexity).
Any unauthenticated remote attacker with network access to the Signal K Server can exploit this vulnerability by sending a malicious WebSocket subscription request containing specially crafted regex metacharacters in the `context` parameter. No privileges, user interaction, or prior authentication are required, making it highly accessible over the network. Successful exploitation causes the Node.js event loop to enter a resource-intensive backtracking loop, resulting in total server unresponsiveness to all API calls and socket connections, effectively denying service to legitimate users and connected boat systems.
Mitigation is available via the patch in Signal K Server version 2.25.0, which addresses the ReDoS flaw in WebSocket handling. Security advisories and GitHub references, including GHSA-7gcj-phff-2884, the fixing commit (215d81eb700d5419c3396a0fbf23f2e246dfac2d), pull request #2568, and the v2.25.0 release notes, recommend immediate upgrading to 2.25.0 or later. Practitioners should review exposed Signal K Server instances, especially on marine networks, and apply the update promptly.
Details
- CWE(s)