CVE-2026-39320: Signal K Server ReDoS DoS Vulnerability

CVE-2026-39320 Overview

CVE-2026-39320 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting Signal K Server, a server application designed to run on a central hub in boats for marine data management. This vulnerability exists in the WebSocket subscription handling logic and can be exploited by unauthenticated attackers to cause a complete Denial of Service condition.

The vulnerability allows attackers to inject unescaped regex metacharacters into the context parameter of a stream subscription, forcing the server's Node.js event loop into catastrophic backtracking when evaluating long string identifiers such as the server's self UUID. This results in CPU utilization spiking to 100% and the server becoming completely unresponsive to all API and WebSocket requests.

Critical Impact

Unauthenticated attackers can remotely crash Signal K Server instances, disrupting marine navigation and monitoring systems aboard vessels.

Affected Products

• Signal K Server versions prior to 2.25.0

Discovery Timeline

• April 21, 2026 - CVE-2026-39320 published to NVD
• April 21, 2026 - Last updated in NVD database

Technical Details for CVE-2026-39320

Vulnerability Analysis

This vulnerability (classified under CWE-400: Uncontrolled Resource Consumption) stems from improper input validation in the WebSocket subscription handling mechanism. When a client subscribes to data streams, the server processes the context parameter as part of a regular expression pattern without proper sanitization.

The core issue lies in how the server constructs and evaluates regular expressions using user-supplied input. When an attacker provides specially crafted input containing regex metacharacters, the resulting pattern can exhibit exponential time complexity when matched against certain strings—particularly the server's UUID, which is a predictably long alphanumeric string.

This type of algorithmic complexity attack leverages the inherent behavior of regex engines that use backtracking algorithms. When confronted with ambiguous patterns and long input strings, these engines can enter states where they explore an exponential number of possible matches before determining success or failure.

Root Cause

The root cause is the lack of input sanitization for regex metacharacters in the context parameter of WebSocket stream subscriptions. User-controlled input is directly incorporated into regular expression patterns without escaping special characters, allowing attackers to craft malicious patterns that trigger catastrophic backtracking in the Node.js regex engine.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker can establish a WebSocket connection to the Signal K Server and send a subscription message with a maliciously crafted context parameter. The attack exploits the following sequence:

1. Attacker connects to the Signal K Server WebSocket endpoint
2. Attacker sends a subscription request with regex metacharacters embedded in the context field
3. Server attempts to evaluate the constructed regex against long string identifiers
4. The regex engine enters catastrophic backtracking
5. Server CPU reaches 100% utilization, blocking the event loop
6. All subsequent API and WebSocket requests are denied

The attack is particularly dangerous because it requires only a single malicious request to completely incapacitate the server, and no prior authentication or special privileges are needed.

Detection Methods for CVE-2026-39320

Indicators of Compromise

• Unusual WebSocket subscription requests containing regex metacharacters (e.g., .*, +, ?, [], |) in the context parameter
• Sudden and sustained CPU spikes to 100% on the Signal K Server host
• Server becoming unresponsive to legitimate API and WebSocket requests
• WebSocket connections from unknown or suspicious IP addresses prior to service degradation

Detection Strategies

• Monitor WebSocket traffic for subscription messages with suspicious patterns in the context field
• Implement application-level logging to capture and analyze subscription parameters
• Deploy network intrusion detection rules to identify regex metacharacter patterns in WebSocket frames
• Set up alerting for Node.js process CPU utilization exceeding normal thresholds

Monitoring Recommendations

• Configure real-time CPU monitoring for Signal K Server processes with alerts at 80% sustained utilization
• Implement WebSocket connection logging with client IP addresses and subscription parameters
• Deploy application performance monitoring (APM) to detect event loop blocking conditions
• Review server logs regularly for patterns of failed or hanging requests following WebSocket subscriptions

How to Mitigate CVE-2026-39320

Immediate Actions Required

• Upgrade Signal K Server to version 2.25.0 or later immediately
• If immediate upgrade is not possible, restrict network access to the Signal K Server WebSocket endpoint
• Implement network-level rate limiting for WebSocket connections
• Monitor server CPU utilization and configure automatic restart policies if DoS conditions are detected

Patch Information

Signal K Server version 2.25.0 contains the fix for this vulnerability. The patch addresses the ReDoS vulnerability by properly sanitizing user input before incorporating it into regular expression patterns.

For detailed information about the fix, refer to:

• GitHub Security Advisory GHSA-7gcj-phff-2884
• GitHub Pull Request #2568
• GitHub Commit 215d81eb
• Signal K Server Release v2.25.0

Workarounds

• Implement a reverse proxy or web application firewall (WAF) in front of Signal K Server to filter WebSocket subscription requests containing regex metacharacters
• Restrict WebSocket endpoint access to trusted IP addresses or networks only
• Deploy the server behind a VPN to limit exposure to authenticated users
• Implement connection rate limiting at the network level to slow potential attack attempts

# Example: Restrict Signal K Server access using iptables
# Allow only local network access to Signal K WebSocket port (default 3000)
iptables -A INPUT -p tcp --dport 3000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP