Description
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash, leading to a denial of service for the interconnected network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Service Interconnect 2 for RHEL 8 | — | — |
| Red Hat | Service Interconnect 2 for RHEL 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Interconnect 2 | skupper-router +3 | 3.5.3-1.el8 | RHSA-2026:82316 |
Advisories 2
- RHSA-2026:82316 Red Hat Security Advisory: Red Hat Service Interconnect 2.2.3 Release (rpms) Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2026-3941 Red Hat Service Interconnect: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 13, 2026
References
- RHSA-2026:82316 vendor-advisory
- RHSA-2026:82340 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-88763 vdb-entry
- RHBZ#2531301 issue-tracking