CVE-2026-61551

Name of the Vulnerable Software and Affected Versions Icinga 2 versions prior to 2.14.9 Icinga 2 versions prior to 2.15.4 Icinga 2 versions prior to 2.16.2

Description Parsing deeply nested JSON can exhaust the call stack because the nesting depth is not bounded. This issue is reachable by unauthenticated network clients through the service on TCP port 5665, which allows a remote attacker to crash the process. Code execution has not been demonstrated.

Recommendations Update to version 2.14.9. Update to version 2.15.4. Update to version 2.16.2.