CVE-2026-61551 in Icinga
Summary
by MITRE • 09/18/2026
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
Icinga 2 serves as a widely deployed open-source monitoring system designed to track the status of networks, hosts, and services. The software relies heavily on JSON for data exchange between its central master nodes and distributed satellites or clients via the Icinga Remote API. This communication typically occurs over TCP port 5665 using a binary protocol that encapsulates JSON payloads. In versions prior to 2.14.9, 2.15.4, and 2.16.2, the internal parser responsible for processing these incoming JSON structures contains a critical implementation flaw related to recursion depth management. Specifically, when the system encounters deeply nested JSON objects or arrays, it fails to enforce a maximum nesting limit before initiating recursive parsing operations. This lack of bounds checking allows an attacker to craft a maliciously structured payload with excessive levels of indentation and object containment that exceeds the available call stack memory allocated by the operating environment for the Icinga 2 process threads.
The technical flaw manifests as a classic stack exhaustion vulnerability, which is formally categorized under CWE-789: Memory Exhaustion. When an unauthenticated network client connects to the service on port 5665 and submits this excessively nested JSON payload, the parser recursively descends into each level of nesting without verifying if the current depth exceeds safe limits. As the recursion continues deeper than the stack can support, it triggers a stack overflow condition. This results in an immediate termination or crash of the affected Icinga 2 process due to insufficient memory resources on the call stack. Because this parsing path is accessible by any client capable of establishing a TCP connection to port 5665 without prior authentication credentials, the vulnerability presents a significant remote attack surface. An adversary can exploit this condition from anywhere on the network or potentially over the internet if the service is exposed externally, leading to a denial-of-service scenario where the monitoring system becomes unavailable for legitimate operations.
The operational impact of this vulnerability centers on availability rather than confidentiality or integrity in its current known state. The primary consequence is that an attacker can reliably crash the Icinga 2 daemon by sending a single crafted packet containing deeply nested JSON data. This disruption halts all monitoring activities, preventing the collection and reporting of critical infrastructure health metrics until the service is manually restarted. While some memory corruption vulnerabilities may lead to arbitrary code execution if stack buffers are overwritten in specific ways, security analysts have not demonstrated proof-of-concept evidence that this particular stack exhaustion leads to remote code execution. However, the instability introduced by a crashed process can indirectly impact system integrity and availability, especially in environments where automatic restarts do not immediately recover service or where cascading failures occur across distributed monitoring clusters.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1498: Network Denial of Service, specifically the sub-technique related to resource exhaustion through application layer protocols. The attack vector is classified as remote and unauthenticated, making it particularly dangerous in public-facing deployments or poorly segmented internal networks. To mitigate this risk, organizations running affected versions must upgrade Icinga 2 to version 2.14.9, 2.15.4, or 2.16.2 immediately upon availability. These patched releases implement proper bounds checking within the JSON parser to reject payloads that exceed a predefined nesting depth threshold before they can consume excessive stack space. Until upgrades are applied, administrators should consider restricting access to TCP port 5665 using firewall rules to allow only trusted IP addresses or implementing rate-limiting and payload size restrictions at the network perimeter to reduce the likelihood of successful exploitation by opportunistic attackers scanning for vulnerable instances.