rootpwn

critical · CVSS v3 8.6

CVE-2026-61551

Icinga 2, an open-source monitoring system, has a critical vulnerability (CVE-2026-61551) that allows unauthenticated remote clients to cras

Overview

Icinga 2, an open-source monitoring system, has a critical vulnerability (CVE-2026-61551) that allows unauthenticated remote clients to crash the service by sending deeply nested JSON. The flaw exists in versions prior to 2.14.9, 2.15.4, and 2.16.2 and is triggered via TCP port 5665. While no code execution has been demonstrated, the denial‑of‑service impact can disrupt monitoring and alerting.

Description

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process, while possible code execution has not been demonstrated. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

Impact

The vulnerability causes a stack overflow that leads to a crash of the Icinga 2 process, resulting in a denial of service. This affects monitoring infrastructure, alerting, and any dependent services that rely on Icinga 2 for availability and health checks. The impact is limited to confidentiality, integrity, and availability, with availability being the primary concern. Defenders should consider the risk of service disruption in critical environments.

Remediation

Upgrade to a patched release: 2.14.9, 2.15.4, or 2.16.2 or later. If upgrade is not immediately possible, restrict network access to port 5665 to trusted hosts or implement firewall rules to block unauthenticated traffic. Monitor logs for abnormal JSON parsing errors and restart the service if crashes occur.

Risk context

Severity is critical with a CVSS v3 score of 8.6. The lack of EPSS data suggests the risk is high but not quantified; defenders should treat it as urgent due to potential service disruption.

Affected products

  • Icinga 2 2.14.x
  • Icinga 2 2.15.x
  • Icinga 2 2.16.x

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.6
CVSS v4
—
EPSS
—

Icinga Denial of Service JSON parsing Stack overflow Remote Critical Monitoring TCP 5665

← All CVEs

Related CVEs

critical

CVE-2026-81321

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key.

View analysis

critical

CVE-2026-85497

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.

View analysis

critical

CVE-2026-63374

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

View analysis

critical

CVE-2025-66455

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements `recv_pyobj()` using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used by the receiver was supplied through the `POST /distserve/p2p_connect` HTTP endpoint. An attacker who could reach an affected DistServe API server could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload. API-key authentication is not enabled unless the operator explicitly configures it. As a result, affected DistServe deployments without API keys allowed unauthenticated remote code execution with the privileges of the LMDeploy serving process. This issue affects the PyTorch backend when PD-disaggregation/DistServe is enabled. Ordinary deployments that do not use the affected disaggregated-serving path do not expose this data flow. The fix was released in LMDeploy 0.16.0. Users who cannot upgrade immediately should prevent untrusted clients from reaching `/distserve/*` endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes. These measures reduce exposure but do not make pickle deserialization safe.

View analysis