Red Hat Service Interconnect EUVD-2026-75288

The target skupper-router instance must be reachable over the network on its AMQP listener port. No authentication is required (PR:N), but the attacker must craft an AMQP message that specifically triggers the unbounded recursion path in the field parser - this requires knowledge of the AMQP protocol and the parser's structure, reflected in the AC:H rating. Default deployments of Red Hat Service Interconnect expose this listener to peer routers and services, so any network-adjacent entity capable of initiating an AMQP connection is a potential attacker. Exploitation is limited to availability impact only; confidentiality and integrity are not affected. Environments that restrict AMQP access to known-good peers via network policy substantially reduce exposure.

The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a moderate-severity DoS with no confidentiality or integrity impact. The AC:H designation indicates that crafting a message to reliably trigger the recursion limit requires non-trivial skill, reducing opportunistic exploitation risk. The scope is unchanged (S:U), meaning the crash is contained to the skupper-router process itself, though in practice a crashed router disrupts all services in the interconnected fabric - a significant operational impact for environments that depend on it. No active exploitation is confirmed (not listed in CISA KEV), no public proof-of-concept has been identified, and EPSS data is not available in the provided input. The real-world risk is elevated in production deployments where skupper-router is a single point of connectivity between clusters or services: a crash causes a full network partition until the process restarts. For organizations not using Red Hat Service Interconnect, this CVE is irrelevant.

An attacker with network access to a skupper-router's AMQP listener sends a crafted AMQP message containing deeply or pathologically nested field structures designed to maximally recurse the parser. The router's parsing function calls itself repeatedly without a depth check until the process stack is exhausted, causing the router to crash and severing AMQP-based connectivity for all services in the interconnected fabric until the process restarts.