Is CVE-2026-61551 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61551 being exploited in the wild.

How severe is CVE-2026-61551?

High severity, with a CVSS score of 8.6, published 18 September 2026.

Which products and versions are affected?

Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2.

Is there a fix for CVE-2026-61551?

A patch was published on 2026-06-23: fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61551 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-61551?

Check whether you run Icinga 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61551: Icinga 2 stack overflow in JSON parsing

CVE-2026-61551 · Severity: high · CVSS 8.6 · Published 2026-09-18

Icinga 2 is an open source monitoring system that manages infrastructure visibility and alerting. An attacker on the network can send maliciously crafted JSON with deeply nested structures to crash the Icinga 2 monitoring service, causing an outage that prevents detection of other infrastructure problems. No authentication is required and the flaw is reachable directly over the network.

Technologies: Icinga 2. Vendors: Icinga.

Quick answers

Is CVE-2026-61551 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61551 being exploited in the wild.
How severe is CVE-2026-61551?: High severity, with a CVSS score of 8.6, published 18 September 2026.
Which products and versions are affected?: Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2.
Is there a fix for CVE-2026-61551?: A patch was published on 2026-06-23: fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61551 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-61551?: Check whether you run Icinga 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stack overflow in the JSON parser due to unbounded nesting depth. The JsonDecode() function recursively processes nested JSON structures without enforcing a depth limit, allowing deeply nested JSON to exhaust the call stack. The vulnerable paths are reachable by unauthenticated clients over TCP port 5665; the fix adds a default nesting depth limit of 24.

Affected products

Icinga Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2

Timeline

2026-09-18: disclosed
2026-06-23: patched: fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.