# CVE-2026-61551: Icinga 2 stack overflow in JSON parsing

Source: https://junglewise.ai/threats/cve-2026-61551-icinga-2-is-an-open-source-monitoring-system-prior-to-2-14-9-2-15  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-61551 · Severity: high · CVSS 8.6 · Published 2026-09-18

Icinga 2 is an open source monitoring system that manages infrastructure visibility and alerting. An attacker on the network can send maliciously crafted JSON with deeply nested structures to crash the Icinga 2 monitoring service, causing an outage that prevents detection of other infrastructure problems. No authentication is required and the flaw is reachable directly over the network.

Technologies: [Icinga 2](https://junglewise.ai/threats/technologies/icinga-2). Vendors: [Icinga](https://junglewise.ai/threats/vendors/icinga).

## Quick answers

**Is CVE-2026-61551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61551 being exploited in the wild.

**How severe is CVE-2026-61551?** High severity, with a CVSS score of 8.6, published 18 September 2026.

**Which products and versions are affected?** Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2.

**Is there a fix for CVE-2026-61551?** A patch was published on 2026-06-23: fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61551 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-61551?** Check whether you run Icinga 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack overflow in the JSON parser due to unbounded nesting depth. The JsonDecode() function recursively processes nested JSON structures without enforcing a depth limit, allowing deeply nested JSON to exhaust the call stack. The vulnerable paths are reachable by unauthenticated clients over TCP port 5665; the fix adds a default nesting depth limit of 24.

## Affected products

- Icinga Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2

## Timeline

- 2026-09-18: disclosed
- 2026-06-23: patched: fix committed to repository

## References

- [https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee](https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee)
- [https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137](https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137)

## Related threats

- [Icinga 2 API template injection in configuration generation](https://junglewise.ai/threats/cve-2026-61552-icinga-2-is-an-open-source-monitoring-system-from-2-4-until-2-14)
- [Icinga 2 authentication bypass in certificate update JSON-RPC](https://junglewise.ai/threats/cve-2026-61550-icinga-2-is-an-open-source-monitoring-system-from-2-8-until-2-14)