CVE-2026-88763: Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service
A denial-of-service vulnerability was discovered in skupper-router within the AMQP field parser. The flaw is caused by unbounded recursion when processing deeply nested or specially crafted AMQP messages, leading to a stack overflow. An attacker who can send messages to the router can trigger this crash. Exploitation requires the attacker to possess a valid x.509 certificate signed by the Red Hat Service Interconnect network's certificate authority. Successful exploitation results in the skupper-router process crashing, terminating all active connections and preventing new traffic from being routed through the affected node.
Other sources
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash, leading to a denial of service for the interconnected network.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to send AMQP messages to the router and possess a valid X.509 certificate signed by the Red Hat Service Interconnect network certificate authority. This is not exploitable by an unauthenticated party that cannot meet those certificate and message-access requirements.
What is the operational impact of a successful attack?
The crafted message can cause a stack overflow and crash the skupper-router process. This terminates active connections and prevents the affected node from routing new traffic.
What traffic or input should be investigated for signs of attempted exploitation?
Investigate crashes of the skupper-router process, particularly where they coincide with receipt of deeply nested or specially crafted AMQP messages. Also review which certificate holders are authorized by the network certificate authority to send messages to the router.