Icinga 2: Stack overflow via deeply nested JSON objects

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-61551 · Microsoft / collected KEV context

cve-program · CVE-2026-61551

• https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g
• https://github.com/Icinga/icinga2/pull/10908
• https://github.com/Icinga/icinga2/commit/391504eaa9ed9aee81f84008c57ec821974b74ee
• https://github.com/Icinga/icinga2/commit/3d9166ff52ff1a64a286c39af57957d63442c137
• https://github.com/Icinga/icinga2/commit/4964d2444ca5c4fae9036054554e1c6e0025fb89
• https://github.com/Icinga/icinga2/commit/ed163a8aa9d296820dd2ad14c47bf3f6a3fcce7d
• https://github.com/Icinga/icinga2/releases/tag/v2.14.9
• https://github.com/Icinga/icinga2/releases/tag/v2.15.4
• https://github.com/Icinga/icinga2/releases/tag/v2.16.2
• https://icinga.com/blog/icinga2-security-release-v2-16-2

No related operational record is retained in the current change model.