CVE-2026-61551

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

• CWE-674

• https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee
• https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137
• https://github.com/Icinga/icinga2/commit/4964d2444ca5c4fae9036054554e1c6e0025fb89
• https://github.com/Icinga/icinga2/commit/ed163a8aa9d296820dd2ad14c47bf3f6a3fcce7d
• https://github.com/Icinga/icinga2/pull/10908
• https://github.com/Icinga/icinga2/releases/tag/v2.14.9
• https://github.com/Icinga/icinga2/releases/tag/v2.15.4
• https://github.com/Icinga/icinga2/releases/tag/v2.16.2
• https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g
• https://icinga.com/blog/icinga2-security-release-v2-16-2

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61541Zapros, a Python HTTP client, prior to version 0.14.0 is vul…6.9
• CVE-2026-61544libp2p-rust is the official Rust language implementation of …8.2
• CVE-2026-61548Rsyslog is a rocket-fast system for log processing. From 7.5…8.1
• CVE-2026-61549Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipel…9
• CVE-2026-6155A weakness has been identified in Totolink A7100RU 7.4cu.231…9.8
• CVE-2026-61550Icinga 2 is an open source monitoring system. From 2.8 until…9.8
• CVE-2026-61552Icinga 2 is an open source monitoring system. From 2.4 until…7.2
• CVE-2026-61554emp3r0r is a C2 designed by Linux users for Linux environmen…7.5
• CVE-2026-61555OpenEXR is the reference implementation and specification fo…5.5
• CVE-2026-61556LiquidJS is a Shopify / GitHub Pages compatible template eng…8.7
• CVE-2026-61559`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.6
• CVE-2026-6156A security vulnerability has been detected in Totolink A7100…9.8