CVE-2026-61551CWE-674

CVE-2026-61551

High · published September 18, 2026

CVSS v3.1
8.6
EPSS
1%
Percentile
60.6
In the wild
Unconfirmed
What it is

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00941 · 60.6th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-09-18T22:17Z
References (10)
https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee · [email protected]https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137 · [email protected]https://github.com/Icinga/icinga2/commit/4964d2444ca5c4fae9036054554e1c6e0025fb89 · [email protected]https://github.com/Icinga/icinga2/commit/ed163a8aa9d296820dd2ad14c47bf3f6a3fcce7d · [email protected]https://github.com/Icinga/icinga2/pull/10908 · [email protected]https://github.com/Icinga/icinga2/releases/tag/v2.14.9 · [email protected]https://github.com/Icinga/icinga2/releases/tag/v2.15.4 · [email protected]https://github.com/Icinga/icinga2/releases/tag/v2.16.2 · [email protected]https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g · [email protected]https://icinga.com/blog/icinga2-security-release-v2-16-2 · [email protected]
EPSS history
Timeline
  • 20 SEP 03:23Z
    EPSS moved — → 1%
    epss
  • 18 SEP 17:23Z
    Icinga 2: Stack overflow via deeply nested JSON objects
    cvelistv5