SkupperRouter AMQP Parser Recursion DoS (Stack Overflow)
CVE-2026-88763 Published on September 10, 2026
Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash, leading to a denial of service for the interconnected network.
Vulnerability Analysis
CVE-2026-88763 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Timeline
Reported to Red Hat.
Made public. 17 days later.
Weakness Type
What is a Stack Exhaustion Vulnerability?
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
CVE-2026-88763 has been classified to as a Stack Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-88763
Want to know whenever a new CVE is published for Red Hat Service Interconnect? stack.watch will email you.
