Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-dbpe-ejtp-4kay
Vulnerability ID VCID-dbpe-ejtp-4kay
Aliases CVE-2026-39320
GHSA-7gcj-phff-2884
Summary Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
System Score Found at
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2026-39320
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-7gcj-phff-2884
cvssv3.1 7.5 https://github.com/SignalK/signalk-server
generic_textual HIGH https://github.com/SignalK/signalk-server
cvssv3.1 7.5 https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d
generic_textual HIGH https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d
ssvc Track https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d
cvssv3.1 7.5 https://github.com/SignalK/signalk-server/pull/2568
generic_textual HIGH https://github.com/SignalK/signalk-server/pull/2568
ssvc Track https://github.com/SignalK/signalk-server/pull/2568
cvssv3.1 7.5 https://github.com/SignalK/signalk-server/releases/tag/v2.25.0
generic_textual HIGH https://github.com/SignalK/signalk-server/releases/tag/v2.25.0
ssvc Track https://github.com/SignalK/signalk-server/releases/tag/v2.25.0
cvssv3.1 7.5 https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884
cvssv3.1_qr HIGH https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884
generic_textual HIGH https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884
ssvc Track https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-39320
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-39320
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/SignalK/signalk-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none


Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:36:30Z/ Found at https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/SignalK/signalk-server/pull/2568
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none


Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:36:30Z/ Found at https://github.com/SignalK/signalk-server/pull/2568
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/SignalK/signalk-server/releases/tag/v2.25.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none


Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:36:30Z/ Found at https://github.com/SignalK/signalk-server/releases/tag/v2.25.0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none


Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:36:30Z/ Found at https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-39320
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Exploit Prediction Scoring System (EPSS)
Percentile 0.2263
EPSS Score 0.00075
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:46:03.387928+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/39xxx/CVE-2026-39320.json 38.6.0