Icinga 2 unbounded JSON nesting causes stack exhaustion
Deeply nested JSON payloads can exhaust the call stack in Icinga 2 before version 2.14.9, 2.15.4, or 2.16.2. CVSS 8.6 high. Fixed in those same releases.
- Vendor
- Icinga
- Product
- Icinga 2
- CVSS
- 8.6
- EPSS (exploit probability)
- 0.9%
- Status
- patched
- Published
Is CVE-2026-61551 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-61551 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-05 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.9% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-61551 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Icinga 2’s JSON parser does not bound recursion depth. An attacker who can send crafted JSON to the monitoring daemon can cause the call stack to exhaust, crashing the Icinga 2 process. Versions prior to 2.14.9, 2.15.4, and 2.16.2 are affected.
Fixed in Icinga 2.14.9, 2.15.4, and 2.16.2, the same releases that address CVE-2026-61550. Taking down an Icinga 2 instance removes visibility into infrastructure at a time when active monitoring matters most.
See NVD for full details.
Other Icinga CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-61550 Icinga 2 JSON-RPC endpoint skips sender validation, allows node injectionwrite-up | [ CRITICAL ] | 9.8 | 0.7% | — |
