CVE-2026-61551: 
Icinga vulnerability analysis and mitigation

CVE-2026-61551 is a stack overflow vulnerability in Icinga 2, an open-source monitoring system, caused by unbounded JSON nesting depth during parsing. An unauthenticated remote attacker can send crafted deeply nested JSON payloads to the Icinga 2 service on TCP port 5665 to crash the process. Affected versions include all releases prior to 2.14.9, versions 2.15.0–2.15.3, and versions 2.16.0–2.16.1. The vulnerability was disclosed on June 29, 2026, and published to NVD on September 18, 2026, with a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, Feedly).

The root cause is Uncontrolled Recursion (CWE-674): the JsonDecode() function in lib/base/json.cpp used a SAX-based JSON parser (nlohmann::json_sax) without any limit on nesting depth, allowing arbitrarily deep JSON arrays or objects to exhaust the call stack. Because Icinga 2 uses Boost.Asio coroutines with fixed-size stacks (which may be heap-allocated without guard pages), a stack overflow in this context could potentially lead to remote code execution — though this has not been demonstrated (GitHub Advisory, Patch PR). The vulnerable JSON parsing paths are reachable without authentication through the JSON-RPC interface on TCP port 5665, as well as through the HTTP API. The fix enforces a default nesting depth limit of 24 (with JsonDecodeDefaultDepthLimit = 24) and throws a std::runtime_error when the limit is exceeded (Commit 4964d24).

The primary impact is a denial of service: an unauthenticated attacker can crash the entire icinga2 daemon process by sending a single crafted JSON-RPC message to TCP port 5665, disrupting all monitoring operations. Because coroutine stacks may be allocated without guard pages, the developers note that code execution cannot be ruled out, though it has not been demonstrated in practice. The vulnerability also carries low confidentiality and integrity impact scores, reflecting the theoretical risk of memory corruption beyond a simple crash (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is classified as automatable (NVD SSVC) due to the unauthenticated, network-accessible attack vector with low complexity. The EPSS score is approximately 0.51%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing or network-accessible Icinga 2 instances running vulnerable versions (< 2.14.9, 2.15.0–2.15.3, or 2.16.0–2.16.1) using network scanners (e.g., Shodan, Nmap) targeting TCP port 5665.
2. Craft malicious payload: Construct a deeply nested JSON structure exceeding the stack capacity — for example, a JSON array or object nested hundreds or thousands of levels deep (e.g., [[[[...]]]] or {"0":{"1":{"2":...null...}}}).
3. Deliver payload: Send the crafted JSON payload directly to the Icinga 2 JSON-RPC service on TCP port 5665. No authentication is required, as the vulnerable parsing code is reached before any authentication check.
4. Trigger stack overflow: The JsonDecode() function processes the nested structure recursively without a depth bound, exhausting the coroutine's fixed-size stack and crashing the icinga2 daemon process, resulting in denial of service (GitHub Advisory, Patch PR).

• Network: Unexpected or repeated TCP connections to port 5665 from untrusted or external IP addresses; large or malformed JSON-RPC messages observed in network captures targeting the Icinga 2 service.
• Process: Sudden termination or crash of the icinga2 daemon process; core dump files generated in the Icinga 2 working directory following a crash.
• Logs: Icinga 2 log entries showing process restart events or crash signals (e.g., SIGSEGV, SIGABRT) around the time of suspicious network activity; error messages such as JSON decoding recursion limit reached in patched versions (indicating attempted exploitation post-patch).
• System: Repeated automatic restarts of the icinga2 service via systemd or init, potentially indicating repeated crash-inducing requests (GitHub Advisory, Patch PR).

Upgrade Icinga 2 to one of the patched versions: 2.14.9, 2.15.4, or 2.16.2, which enforce a default JSON nesting depth limit of 24 in JsonDecode() (GitHub Advisory, Icinga Blog). There is no in-application workaround; however, as a network-level mitigation, restrict access to TCP port 5665 using firewall rules so that only trusted Icinga agents, satellites, and masters can connect. Prioritize patching for any Icinga 2 instances exposed to untrusted networks.

The Icinga development team published a security advisory (GHSA-wh38-wg57-5w7g) and a blog post announcing the security release on June 29, 2026, coordinated with the patch release (GitHub Advisory, Icinga Blog). Community coverage appeared on Linux-focused news sites and security aggregators including pro-linux.de and AusCERT shortly after disclosure. A Mastodon post by user @hugovalters was noted in threat intelligence feeds, reflecting community awareness of the issue.