Bug 2531301 (CVE-2026-88763) - CVE-2026-88763 skupper-router: skupper-router: Unbounded recursion in AMQP field parser leads to denial of service
Summary: CVE-2026-88763 skupper-router: skupper-router: Unbounded recursion in AMQP fi...
Keywords:
Status: NEW
Alias: CVE-2026-88763
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-10 06:55 UTC by OSIDB Bzimport
Modified: 2026-10-13 18:12 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:82316 0 None None None 2026-10-13 15:00:38 UTC
Red Hat Product Errata RHSA-2026:82340 0 None None None 2026-10-13 18:12:30 UTC

Description OSIDB Bzimport 2026-09-10 06:55:50 UTC
A denial-of-service vulnerability was discovered in skupper-router within the AMQP field parser. The flaw is caused by unbounded recursion when processing deeply nested or specially crafted AMQP messages, leading to a stack overflow. An attacker who can send messages to the router can trigger this crash. Exploitation requires the attacker to possess a valid x.509 certificate signed by the Red Hat Service Interconnect network's certificate authority. Successful exploitation results in the skupper-router process crashing, terminating all active connections and preventing new traffic from being routed through the affected node.

Comment 1 Jon Orris 2026-10-13 15:00:37 UTC
This issue has been addressed in the following products:

  Service Interconnect 2 for RHEL 8
  Service Interconnect 2 for RHEL 9

Via RHSA-2026:82316 https://access.redhat.com/errata/RHSA-2026:82316

Comment 2 Jon Orris 2026-10-13 18:12:30 UTC
This issue has been addressed in the following products:

  Service Interconnect 2 for RHEL 9

Via RHSA-2026:82340 https://access.redhat.com/errata/RHSA-2026:82340


Note You need to log in before you can comment on or make changes to this bug.