Unauthenticated remote attackers can crash the Icinga 2 monitoring service by sending specially crafted, deeply nested JSON payloads, resulting in a denial of service.

The application fails to bound the nesting depth during JSON parsing, leading to uncontrolled recursion (CWE-674) and stack exhaustion. This vulnerability is reachable by unauthenticated network clients via the Icinga 2 service on TCP port 5665.

Successful exploitation of this vulnerability results in a denial of service, which disrupts critical infrastructure monitoring capabilities. Given the CVSS score of 8.6, the high availability impact poses a significant risk to operational visibility and incident response coordination. While remote code execution has not been demonstrated, the ability for unauthenticated actors to remotely terminate the monitoring service constitutes a severe availability risk.

Immediate Action: Upgrade to Icinga 2 version 2.14.9, 2.15.4, 2.16.2, or later to incorporate the necessary bounds checking for JSON parsing.

Proactive Monitoring: Monitor Icinga 2 service logs for unexpected process crashes or frequent restarts and inspect network traffic on TCP port 5665 for suspicious, deeply nested JSON structures.

Compensating Controls: Deploy a network firewall or Web Application Firewall to restrict access to TCP port 5665 to known, trusted management segments, thereby reducing the attack surface.

Public Exploit Available: No

This vulnerability presents a high risk to service availability due to the ease of reachability for unauthenticated attackers. Security teams should prioritize patching Icinga 2 instances immediately to ensure monitoring stability. If patching is delayed, ensure that access to the Icinga 2 service port is strictly limited to authorized administrative sources.