CVE-2026-39320Disclosure(signalk / signal_k_server)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch signalk signal_k_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.

signalk CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Other references

https://github.com/SignalK/signalk-server/releases/tag/v2.25.0

Weakness type (CWE)

CWE-400CWE-1333

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

signal_k_server

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-04-21); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

signalk

Products

signal_k_server

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

cvereports@_cvereports163d
Disclosure
CVE-2026-39320: CVE-2026-39320: Unauthenticated ReDoS in Signal K Server WebSocket Subscriptions Signal K Server prior to version 2.25.0 contains a Regular Expression Denial of Service (ReDoS) vulnerability in its WebSocket subscription handling modul... https://cvereports.com/reports/CVE-2026-39320
Post summary
CVE-2026-39320 is a ReDoS vulnerability affecting Signal K Server WebSocket subscriptions in versions prior to 2.25.0; upgrading to or beyond 2.25.0 provides a remediation.
0000026
36 followersView on X
DailyCVE@dailycve170d
Disclosure
🔴 SignalK Server, Regular Expression Denial of Service (ReDoS), #CVE-2026-39320 (critical) https://dailycve.com/signalk-server-regular-expression-denial-of-service-redos-cve-2026-39320-critical/
Post summary
The text announces a newly disclosed ReDoS vulnerability (CVE‑2026‑39320) in SignalK Server, providing its type but no PoC, exploit, or mitigation details.
0000045
183 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	signalk	signal_k_server	-	-	-

Explore more

Back to dashboard signalk CVEs signal_k_server vulnerabilities