CVE-2014-2386: Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial...

Security readout for executives and security teams

CVE-2014-2386 is an Icinga web CGI flaw that could let a remote attacker crash the service. The public record describes multiple one-byte boundary errors causing stack-based buffer overflow conditions. Business impact is mainly monitoring disruption, which can reduce visibility during incidents. Exposure is most likely where legacy Icinga CGI interfaces are reachable by users or networks beyond trusted administrators. The source bundle does not provide precise CPEs, supported fixed versions, or authenticated-versus-unauthenticated reachability details. Treat this as a legacy monitoring availability risk. Prioritize remediation if Icinga CGI is internet-facing, broadly reachable internally, or monitoring uptime is critical to incident response. Mitigation focus: Inventory Icinga core and CGI versions across monitoring servers.; Check Icinga issue 5663, the referenced commit, and your OS vendor advisory.; Apply the relevant vendor package update when applicable..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.