{"id":"CVE-2026-61551","published":"2026-09-18T18:17:08.393","lastModified":"2026-09-24T21:17:43.237","description":"Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cwes":["CWE-674"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee","tags":[]},{"url":"https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137","tags":[]},{"url":"https://github.com/Icinga/icinga2/commit/4964d2444ca5c4fae9036054554e1c6e0025fb89","tags":[]},{"url":"https://github.com/Icinga/icinga2/commit/ed163a8aa9d296820dd2ad14c47bf3f6a3fcce7d","tags":[]},{"url":"https://github.com/Icinga/icinga2/pull/10908","tags":[]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.14.9","tags":[]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.15.4","tags":[]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.16.2","tags":[]},{"url":"https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g","tags":[]},{"url":"https://icinga.com/blog/icinga2-security-release-v2-16-2","tags":[]}],"exploitRefs":[{"url":"https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee","tags":[]},{"url":"https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137","tags":[]},{"url":"https://github.com/Icinga/icinga2/commit/4964d2444ca5c4fae9036054554e1c6e0025fb89","tags":[]},{"url":"https://github.com/Icinga/icinga2/commit/ed163a8aa9d296820dd2ad14c47bf3f6a3fcce7d","tags":[]},{"url":"https://github.com/Icinga/icinga2/pull/10908","tags":[]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.14.9","tags":[]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.15.4","tags":[]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.16.2","tags":[]},{"url":"https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows unauthenticated attackers to crash the Icinga 2 process by sending deeply nested JSON, posing a significant risk to the availability of the service.","exploitability":"Exploitation is relatively easy given the unauthenticated nature and the reachable service endpoint. Attackers need network access to the Icinga 2 service on TCP port 5665.","blast_radius":"If exploited, the crash could disrupt monitoring services, leading to potential service downtime and loss of visibility into the health of monitored systems.","remediation":"Upgrade to Icinga 2 version 2.14.9, 2.15.4, or 2.16.2.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","json-parsing","network"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T09:29:55.595Z"}}