Signal K Server DoS: Unauthenticated ReDoS Attack Hits Marine Systems

The National Vulnerability Database has disclosed CVE-2026-39320, a high-severity (CVSS 7.5) unauthenticated Regular Expression Denial of Service (ReDoS) vulnerability impacting Signal K Server versions prior to 2.25.0. This server application, commonly found on boats as a central hub for marine data, is susceptible via its WebSocket subscription handling logic.

Attackers can exploit this by injecting unescaped regex metacharacters into the context parameter of a stream subscription. This forces the server’s Node.js event loop into a catastrophic backtracking loop when processing long string identifiers, such as the server’s own UUID. The result is a complete Denial of Service, with the server CPU spiking to 100% and becoming unresponsive to all API and socket requests.

This isn’t just a nuisance; it’s a critical operational risk for any vessel relying on Signal K. An unauthenticated DoS means an attacker doesn’t need prior access or credentials. For defenders, this means immediate patching is non-negotiable. Version 2.25.0 contains the fix, so prioritize this update to prevent total system outages on affected marine platforms.