CVE-2026-61551 — Icinga 2: Stack overflow via deeply nested JSON objects

Description

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

Affected products

Vendor	Product	Affected	Fixed
Icinga	icinga2	< 2.14.9, >= 2.15.0, < 2.15.4, >= 2.16.0, < 2.16.2	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	icinga2	2.16.2-1	—
Debian 13	icinga2	2.14.6-1+deb13u1	—
Debian 12	icinga2	No fix yet	—

Ubuntu