Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-39320 · Microsoft / collected KEV context

EUVD-2026-24021

GHSA-7gcj-phff-2884

cve-program · CVE-2026-39320

• https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884
• https://github.com/SignalK/signalk-server/pull/2568
• https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d
• https://github.com/SignalK/signalk-server/releases/tag/v2.25.0

euvd · EUVD-2026-24021

• https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884
• https://github.com/SignalK/signalk-server/pull/2568
• https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d
• https://github.com/SignalK/signalk-server/releases/tag/v2.25.0

nvd · CVE-2026-39320

• https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d
• https://github.com/SignalK/signalk-server/pull/2568
• https://github.com/SignalK/signalk-server/releases/tag/v2.25.0
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884

osv · GHSA-7gcj-phff-2884

• https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884
• https://nvd.nist.gov/vuln/detail/CVE-2026-39320
• https://github.com/SignalK/signalk-server/pull/2568
• https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d
• https://github.com/SignalK/signalk-server
• https://github.com/SignalK/signalk-server/releases/tag/v2.25.0

No related operational record is retained in the current change model.