SB2026092264 - Debian update for icinga2
Published: September 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2025-61907)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in filter expressions. A remote user can gain unauthorized access to sensitive information on the system.
2) NULL pointer dereference (CVE-ID: CVE-2025-61908)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote user can pass specially crafted data to the application and perform a denial of service (DoS) attack.
3) Execution with unnecessary privileges (CVE-ID: CVE-2025-61909)
CWE-ID: CWE-250 - Execution with Unnecessary Privileges
CVSSv4: 4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to execution with unnecessary privileges. A local administrator can send signals to processes it would otherwise not permitted to.
4) Improper access control (CVE-ID: CVE-2026-61550)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to take control over the node.
The vulnerability exists due to improper access control in certificate update JSON-RPC message handling when processing certificate update messages. A remote attacker can send a specially crafted certificate update message to take control over the node.
An attacker can update both the node's own certificate and the trusted CA certificate, enabling impersonation of a trusted node.
5) Stack-based buffer overflow (CVE-ID: CVE-2026-61551)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to stack-based buffer overflow in the JSON parser when processing deeply nested JSON objects. A remote attacker can send specially crafted JSON input to cause a denial of service.
The affected code is reachable by unauthenticated clients over the network. The possibility of code execution cannot be ruled out, but it has not been demonstrated.
6) Input validation error (CVE-ID: CVE-2026-61552)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper input validation in the /v1/objects API endpoint when writing template names to generated configuration files. A remote privileged user can submit a specially crafted request to escalate privileges.
Exploitation is limited to API users with permission to create configuration objects.
Remediation
Install update from vendor's website.