CVE-2026-61551
8.6 HIGHpublic exploit availablePublished 2026-09-18 · Updated 2026-09-24
AI risk analysis
- Summary
- The flaw allows unauthenticated attackers to crash the Icinga 2 process by sending deeply nested JSON, posing a significant risk to the availability of the service.
- Exploitability
- Exploitation is relatively easy given the unauthenticated nature and the reachable service endpoint. Attackers need network access to the Icinga 2 service on TCP port 5665.
- Blast radius
- If exploited, the crash could disrupt monitoring services, leading to potential service downtime and loss of visibility into the health of monitored systems.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Icinga 2 version 2.14.9, 2.15.4, or 2.16.2.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weaknesses
CWE-674
Public exploit & PoC references
- https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee
- https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137
- https://github.com/Icinga/icinga2/commit/4964d2444ca5c4fae9036054554e1c6e0025fb89
- https://github.com/Icinga/icinga2/commit/ed163a8aa9d296820dd2ad14c47bf3f6a3fcce7d
- https://github.com/Icinga/icinga2/pull/10908
- https://github.com/Icinga/icinga2/releases/tag/v2.14.9
- https://github.com/Icinga/icinga2/releases/tag/v2.15.4
- https://github.com/Icinga/icinga2/releases/tag/v2.16.2
- https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g
All references
- https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee
- https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137
- https://github.com/Icinga/icinga2/commit/4964d2444ca5c4fae9036054554e1c6e0025fb89
- https://github.com/Icinga/icinga2/commit/ed163a8aa9d296820dd2ad14c47bf3f6a3fcce7d
- https://github.com/Icinga/icinga2/pull/10908
- https://github.com/Icinga/icinga2/releases/tag/v2.14.9
- https://github.com/Icinga/icinga2/releases/tag/v2.15.4
- https://github.com/Icinga/icinga2/releases/tag/v2.16.2
- https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g
- https://icinga.com/blog/icinga2-security-release-v2-16-2
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-66274
- HIGHCVE-2026-67552
- CRITICALCVE-2017-20242
- CRITICALCVE-2026-0163
- CRITICALCVE-2026-101000PoC
- CRITICALCVE-2026-101038PoC
- CRITICALCVE-2026-101077PoC
- HIGHCVE-2026-11375
Related by shared AI tags and CWE weakness class. Browse the full archive.