An unauthenticated remote attacker can cause a total denial of service in Signal K Server versions prior to 2.25.0 by exploiting a catastrophic backtracking vulnerability in WebSocket subscription requests.

This vulnerability is an uncontrolled resource consumption flaw (CWE-400) caused by inefficient regular expression complexity (CWE-1333). An unauthenticated attacker can inject malicious regex metacharacters into the context parameter of a stream subscription, forcing the Node.js event loop into a state of catastrophic backtracking.

Successful exploitation results in total service unavailability, as the server CPU hits 100% capacity and stops responding to API or socket requests. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to operational continuity for maritime systems relying on the Signal K Server for critical data aggregation.

Immediate Action: Update the Signal K Server application to version 2.25.0 or later to implement the necessary regex sanitization and resolve the backtracking issue.

Proactive Monitoring: Monitor server CPU utilization and WebSocket traffic logs for unusual patterns or spikes in connection requests that may indicate an attempt to trigger the denial of service.

Compensating Controls: Implement rate limiting on WebSocket subscription requests at the network or application layer to mitigate the impact of malicious input while planning the software update.

Public Exploit Available: Unknown.

The risk posed by CVE-2026-39320 is significant due to the ease of exploitation and the resulting impact on system availability. Administrators must prioritize updating to version 2.25.0 immediately to prevent potential service disruptions. Given the nature of the software, maintaining system uptime is critical, and applying this patch is the only definitive way to eliminate the vulnerability.