Executive brief
Icinga 2 is an open source monitoring system that manages infrastructure visibility and alerting. An attacker on the network can send maliciously crafted JSON with deeply nested structures to crash the Icinga 2 monitoring service, causing an outage that prevents detection of other infrastructure problems. No authentication is required and the flaw is reachable directly over the network.
Technical details
The vulnerability is a stack overflow in the JSON parser due to unbounded nesting depth. The JsonDecode() function recursively processes nested JSON structures without enforcing a depth limit, allowing deeply nested JSON to exhaust the call stack. The vulnerable paths are reachable by unauthenticated clients over TCP port 5665; the fix adds a default nesting depth limit of 24.
Affected products
- Icinga Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2
Timeline
- 2026-09-18: disclosed
- 2026-06-23: patched: fix committed to repository