CVE-2026-61551
HighCVSS 8.6Summary
Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2 does not bound JSON nesting depth, allowing deeply nested JSON to exhaust the call stack. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process.
Risk Assessment
An attacker can remotely crash the Icinga 2 process, causing monitoring downtime and potential container restart loops.
Recommendation
Upgrade Icinga 2 to version 2.14.9, 2.15.4, or 2.16.2 (or later), which fix this issue.
Other vulnerabilities in Icinga 2
See all- CVE-2026-61552High
Icinga 2 from 2.4 until 2.14.9, 2.15.4, and 2.16.2 writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, create additional objects, and exceed the user's assigned privileges.
- CVE-2026-61550Critical
Icinga 2 from 2.8 to 2.14.9, 2.15.4, and 2.16.2 has a vulnerability in certificate update JSON-RPC message handling where the sender is not validated as a trusted endpoint. An unauthenticated attacker with access to TCP port 5665 can replace the node certificate and CA certificate, impersonate a trusted node, and take control.
Original NVD description (English source)
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.