Cyber Posture

CVE-2026-39320

HighPublic PoC

Published: 21 April 2026

Published
21 April 2026
Modified
24 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0005 15.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-39320 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Signalk Signal K Server. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 15.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Flaw remediation directly mitigates this ReDoS vulnerability by applying the patch in Signal K Server version 2.25.0 that fixes the unescaped regex metacharacters in WebSocket handling.

prevent

Information input validation on the 'context' parameter in WebSocket subscription requests prevents injection of malicious regex metacharacters that trigger catastrophic backtracking.

prevent

Denial-of-service protection implements mechanisms to limit resource exhaustion from ReDoS attacks, such as CPU spikes caused by regex evaluation on long string identifiers.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

The ReDoS vulnerability enables direct exploitation of the public-facing Signal K Server via a crafted WebSocket request, causing application-level resource exhaustion and unresponsiveness, which maps to Application or System Exploitation under Endpoint Denial of Service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting…

more

unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.

Deeper analysisAI

Signal K Server, a Node.js application that serves as a central data hub for boat instrumentation and networking, is affected by CVE-2026-39320 in versions prior to 2.25.0. The vulnerability is an unauthenticated Regular Expression Denial of Service (ReDoS) in the WebSocket subscription handling logic. Attackers can inject unescaped regex metacharacters into the `context` parameter of a stream subscription request, triggering catastrophic backtracking in the server's regex evaluation, particularly when processing long string identifiers such as the server's self UUID. This leads to a complete denial of service with CPU utilization spiking to 100%, rendering the server unresponsive. The issue is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (Inefficient Regular Expression Complexity).

Any unauthenticated remote attacker with network access to the Signal K Server can exploit this vulnerability by sending a malicious WebSocket subscription request containing specially crafted regex metacharacters in the `context` parameter. No privileges, user interaction, or prior authentication are required, making it highly accessible over the network. Successful exploitation causes the Node.js event loop to enter a resource-intensive backtracking loop, resulting in total server unresponsiveness to all API calls and socket connections, effectively denying service to legitimate users and connected boat systems.

Mitigation is available via the patch in Signal K Server version 2.25.0, which addresses the ReDoS flaw in WebSocket handling. Security advisories and GitHub references, including GHSA-7gcj-phff-2884, the fixing commit (215d81eb700d5419c3396a0fbf23f2e246dfac2d), pull request #2568, and the v2.25.0 release notes, recommend immediate upgrading to 2.25.0 or later. Practitioners should review exposed Signal K Server instances, especially on marine networks, and apply the update promptly.

Details

CWE(s)

Affected Products

signalk
signal k server
≤ 2.25.0

CVEs Like This One

CVE-2025-68272Same product: Signalk Signal K Server
CVE-2025-66398Same product: Signalk Signal K Server
CVE-2025-68619Same product: Signalk Signal K Server
CVE-2025-69203Same product: Signalk Signal K Server
CVE-2025-68620Same product: Signalk Signal K Server
CVE-2026-33950Same product: Signalk Signal K Server
CVE-2026-33951Same product: Signalk Signal K Server
CVE-2026-23515Same product: Signalk Signal K Server
CVE-2026-24001Shared CWE-1333, CWE-400
CVE-2025-69873Shared CWE-1333, CWE-400

References