CVE-2026-39320

{
  "id": "CVE-2026-39320",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T01:16:05.063",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix."
    },
    {
      "lang": "es",
      "value": "Signal K Server es una aplicación de servidor que se ejecuta en un concentrador central en una embarcación. Las versiones anteriores a la 2.25.0 son vulnerables a un ataque de denegación de servicio de expresión regular (ReDoS) no autenticado dentro de la lógica de manejo de suscripciones de WebSocket. Al inyectar metacaracteres de regex sin escapar en el parámetro ’context’ de una suscripción de flujo, un atacante puede forzar el bucle de eventos de Node.js del servidor a un bucle de retroceso catastrófico al evaluar identificadores de cadena largos (como el UUID propio del servidor). Esto resulta en una denegación de servicio (DoS) total donde la CPU del servidor se dispara al 100% y se vuelve completamente insensible a futuras solicitudes de API o de socket. La versión 2.25.0 contiene una solución."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SignalK",
          "product": "signalk-server",
          "versions": [
            {
              "version": "< 2.25.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-21T19:36:30.279521Z",
          "id": "CVE-2026-39320",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.25.0",
              "matchCriteriaId": "2DAD2E1E-F9F3-40FA-B483-3AB2A3093CFB"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/SignalK/signalk-server/pull/2568",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/SignalK/signalk-server/releases/tag/v2.25.0",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}