CVE-2026-61551: Icinga 2: Stack overflow via deeply nested JSON objects
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Icinga 2to a version that resolves this vulnerability.Fixed in 2.14.9 - Upgrade
Upgrade
Icinga 2to a version that resolves this vulnerability.Fixed in 2.15.4 - Upgrade
Upgrade
Icinga 2to a version that resolves this vulnerability.Fixed in 2.16.2 - Compensating control
Limit access to the Icinga 2 service on TCP port 5665 to trusted sources only (unauthenticated network clients can reach the affected JSON parsing paths).
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments running an affected Icinga 2 version with its service reachable by network clients on TCP port 5665 are exposed. The vulnerable JSON parsing paths can be reached without authentication.
What does an attacker need to do to trigger the issue?
An attacker only needs network access to TCP port 5665 and can submit deeply nested JSON objects. No credentials or user interaction are required.
What is the demonstrated impact?
Deeply nested JSON can exhaust the call stack and crash the Icinga 2 process, causing a denial of service. Possible code execution has not been demonstrated.
What versions contain the fix?
The issue is fixed in Icinga 2 versions 2.14.9, 2.15.4, and 2.16.2.