CVE Record
[ HIGH ]CVE-2026-61551
Icinga 2 unbounded JSON nesting causes stack exhaustion
Deeply nested JSON payloads can exhaust the call stack in Icinga 2 before version 2.14.9, 2.15.4, or 2.16.2. CVSS 8.6 high. Fixed in those same releases.
- Vendor
- Icinga
- Product
- Icinga 2
- CVSS
- 8.6
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Icinga 2’s JSON parser does not bound recursion depth. An attacker who can send crafted JSON to the monitoring daemon can cause the call stack to exhaust, crashing the Icinga 2 process. Versions prior to 2.14.9, 2.15.4, and 2.16.2 are affected.
Fixed in Icinga 2.14.9, 2.15.4, and 2.16.2, the same releases that address CVE-2026-61550. Taking down an Icinga 2 instance removes visibility into infrastructure at a time when active monitoring matters most.
See NVD for full details.
