Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-10T06:56:33 skupper-router: skupper-router: Unbounded recursion in AMQP field parser leads to denial of service 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-674

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash, leading to a denial of service for the interconnected network.

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash, leading to a denial of service for the interconnected network.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to have a valid x.509 certificate signed by the internal network's certificate authority. Successful exploitation allows an attacker to crash the skupper-router process, leading to a denial of service. The vulnerability's root cause is a lack of recursion depth limits in the AMQP field parsing logic. Red Hat would like to thank Gjoko Krstic (Zero Science Lab) for reporting this issue. Red Hat Service Interconnect 2 Affected skupper-router https://www.cve.org/CVERecord?id=CVE-2026-88763 https://nvd.nist.gov/vuln/detail/CVE-2026-88763