CVE-2026-61551

Published: Sep 18, 2026Modified: Sep 24, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Exploitability: 3.9 / Impact: 4.7

Source: security-advisories@github.com (Secondary)

Description

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

Related CWEs

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (10)

https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee

Source: security-advisories@github.com

https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137

Source: security-advisories@github.com

https://github.com/Icinga/icinga2/commit/4964d2444ca5c4fae9036054554e1c6e0025fb89

Source: security-advisories@github.com

https://github.com/Icinga/icinga2/commit/ed163a8aa9d296820dd2ad14c47bf3f6a3fcce7d

Source: security-advisories@github.com

https://github.com/Icinga/icinga2/pull/10908

Source: security-advisories@github.com

https://github.com/Icinga/icinga2/releases/tag/v2.14.9

Source: security-advisories@github.com

https://github.com/Icinga/icinga2/releases/tag/v2.15.4

Source: security-advisories@github.com

https://github.com/Icinga/icinga2/releases/tag/v2.16.2

Source: security-advisories@github.com

https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g

Source: security-advisories@github.com

https://icinga.com/blog/icinga2-security-release-v2-16-2

Source: security-advisories@github.com

Timeline

No history available yet.