CVE-2026-39320

BRIEFING NOTE: CVE-2026-39320 Signal K Server versions prior to 2.25.0 contain an unauthenticated Regular Expression Denial of Service vulnerability in the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the context parameter, an attacker can trigger catastrophic backtracking when the server processes long string identifiers, rendering the affected hub completely unresponsive. The vulnerability is highly exploitable with a CVSS score of 7.5 (HIGH), requiring no authentication, no special network conditions, and no user interaction. The attack vector is network-based and targets the availability of the service, causing CPU utilization to spike to 100% and disabling all API and socket communications. This represents a complete denial of service condition for the affected marine navigation system. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence platforms. The EPSS score of 0.0004 indicates minimal real-world exploitation probability. Organizations running affected versions should upgrade to 2.25.0 immediately as part of routine patch management to prevent potential service disruption.