CVE-2026-39320

{"id": "CVE-2026-39320", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39320", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T19:36:30.279521Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "SignalK", "product": "signalk-server", "versions": [{"status": "affected", "version": "< 2.25.0"}]}]}], "published": "2026-04-21T01:16:05.063", "references": [{"url": "https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/SignalK/signalk-server/pull/2568", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/SignalK/signalk-server/releases/tag/v2.25.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix."}, {"lang": "es", "value": "Signal K Server es una aplicaci\u00f3n de servidor que se ejecuta en un concentrador central en una embarcaci\u00f3n. Las versiones anteriores a la 2.25.0 son vulnerables a un ataque de denegaci\u00f3n de servicio de expresi\u00f3n regular (ReDoS) no autenticado dentro de la l\u00f3gica de manejo de suscripciones de WebSocket. Al inyectar metacaracteres de regex sin escapar en el par\u00e1metro \u2019context\u2019 de una suscripci\u00f3n de flujo, un atacante puede forzar el bucle de eventos de Node.js del servidor a un bucle de retroceso catastr\u00f3fico al evaluar identificadores de cadena largos (como el UUID propio del servidor). Esto resulta en una denegaci\u00f3n de servicio (DoS) total donde la CPU del servidor se dispara al 100% y se vuelve completamente insensible a futuras solicitudes de API o de socket. La versi\u00f3n 2.25.0 contiene una soluci\u00f3n."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DAD2E1E-F9F3-40FA-B483-3AB2A3093CFB", "versionEndExcluding": "2.25.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}