CVE-2026-61551
CVE-2026-61551 · Icinga 2: Stack overflow via deeply nested JSON objects
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
CVSS 8.6 · High · EPSS 0.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
icinga2
- Versions
- < 2.14.9: Affected
- >= 2.15.0, < 2.15.4: Affected
- >= 2.16.0, < 2.16.2: Affected
No fix published
icinga2 Debian:12
- Versions
- 2.13.6-2
- 2.13.6-2+deb12u1
- 2.13.6-2+deb12u2
- 2.13.7-1
- 2.13.7-1~exp1
- 2.13.8-1
- 2.14.0-1~exp1
- 2.14.1-1
- 2.14.2-1
- 2.14.2-1+loong64
- 2.14.3-1
- 2.14.4-1
- 2.14.5-1
- 2.14.6-1
- 2.15.0-1
- 2.15.0-1~exp1
- 2.15.1-1
- 2.15.2-1
- 2.15.2-2
- 2.16.0-1
- 2.16.0-2
- 2.16.0-3~exp1
- 2.16.0-3~exp2
- 2.16.0-3~exp3
- 2.16.0-3~exp4
- 2.16.1-1
- 2.16.1-1~exp1
- 2.16.2-1
- 2.16.2-2
- 2.16.3-1
- 2.16.4-1
- 2.16.5-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Debian:13
- Versions
- 2.14.6-1
- Affected ranges
- ECOSYSTEM: < 2.14.6-1+deb13u1
Update to 2.14.6-1+deb13u1
icinga2 Debian:14
- Versions
- 2.14.6-1
- 2.15.0-1
- 2.15.0-1~exp1
- 2.15.1-1
- 2.15.2-1
- 2.15.2-2
- 2.16.0-1
- 2.16.0-2
- 2.16.0-3~exp1
- 2.16.0-3~exp2
- 2.16.0-3~exp3
- 2.16.0-3~exp4
- 2.16.1-1
- 2.16.1-1~exp1
- Affected ranges
- ECOSYSTEM: < 2.16.2-1
Update to 2.16.2-1
icinga2 Ubuntu:16.04:LTS
- Versions
- 2.3.8-1build1
- 2.3.11-1
- 2.4.0-1
- 2.4.1-1
- 2.4.1-2
- 2.4.1-2ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:18.04:LTS
- Versions
- 2.7.0-1
- 2.8.1-0ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:20.04:LTS
- Versions
- 2.10.5-1build1
- 2.11.2-1
- 2.11.2-1ubuntu1
- 2.11.2-1ubuntu2
- 2.11.2-1ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:22.04:LTS
- Versions
- 2.12.3-1
- 2.13.1-1
- 2.13.2-1
- 2.13.2-1build1
- 2.13.2-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:24.04:LTS
- Versions
- 2.13.8-1
- 2.14.1-1
- 2.14.2-1
- 2.14.2-1build1
- 2.14.2-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:26.04:LTS
- Versions
- 2.15.0-1
- 2.15.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g
- https://github.com/Icinga/icinga2/pull/10908
- https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee
- https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137
- https://github.com/Icinga/icinga2/commit/4964d2444ca5c4fae9036054554e1c6e0025fb89
- https://github.com/Icinga/icinga2/commit/ed163a8aa9d296820dd2ad14c47bf3f6a3fcce7d
- https://github.com/Icinga/icinga2/releases/tag/v2.14.9
- https://github.com/Icinga/icinga2/releases/tag/v2.15.4
- https://github.com/Icinga/icinga2/releases/tag/v2.16.2
- https://icinga.com/blog/icinga2-security-release-v2-16-2
- https://nvd.nist.gov/vuln/detail/CVE-2026-61551