CVE-2026-88763 Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service
An attacker can crash the skupper-router by sending a crafted AMQP message, causing a denial of service for interconnected services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-88763?
CVE-2026-88763 is a medium-severity denial of service vulnerability in Red Hat Service Interconnect 2 for RHEL 8, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash, leading to a denial of service for the interconnected network.
Weakness: CWE-674
Which versions are affected by CVE-2026-88763?
Linux distribution packages (12)
skupper-router Red Hat:service_interconnect:2.0::el8 | All versions | 0:3.5.3-1.el8 |
skupper-router-common Red Hat:service_interconnect:2.0::el8 | All versions | 0:3.5.3-1.el8 |
skupper-router-debuginfo Red Hat:service_interconnect:2.0::el8 | All versions | 0:3.5.3-1.el8 |
skupper-router-debugsource Red Hat:service_interconnect:2.0::el8 | All versions | 0:3.5.3-1.el8 |
skupper-router-docs Red Hat:service_interconnect:2.0::el8 | All versions | 0:3.5.3-1.el8 |
skupper-router-tools Red Hat:service_interconnect:2.0::el8 | All versions | 0:3.5.3-1.el8 |
skupper-router Red Hat:service_interconnect:2.0::el9 | All versions | 0:3.5.3-1.el9 |
skupper-router-common Red Hat:service_interconnect:2.0::el9 | All versions | 0:3.5.3-1.el9 |
skupper-router-debuginfo Red Hat:service_interconnect:2.0::el9 | All versions | 0:3.5.3-1.el9 |
skupper-router-debugsource Red Hat:service_interconnect:2.0::el9 | All versions | 0:3.5.3-1.el9 |
skupper-router-docs Red Hat:service_interconnect:2.0::el9 | All versions | 0:3.5.3-1.el9 |
skupper-router-tools Red Hat:service_interconnect:2.0::el9 | All versions | 0:3.5.3-1.el9 |
How do I fix CVE-2026-88763?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-88763 being exploited?
There is no known exploitation of CVE-2026-88763 in the wild and no public exploit code.
Sources
Also known as GHSA-j54j-r8q7-v2hq, RHSA-2026:82316.