CVE-2025-61908

Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference

MEDIUM

6.5

CVSS Score

Published: October 16, 2025 at 05:16 PM UTC

Updated: October 9, 2026 at 10:10 AM UTC

1 product affected across 1 vendorIcinga

Using icinga2 by Icinga?

Get instant alerts when new vulnerabilities affect icinga2 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 0.5%

SSVC

No known exploit

Description

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. This can be used by any API user with access to an API endpoint that allows specifying a filter expression to crash the Icinga 2 daemon. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Icinga · Icinga

95%

2.10.0 ≤ v < 2.13.132.14.0 ≤ v < 2.14.72.15.0 ≤ v < 2.15.1*>=2.10.0, < 2.13.13>=2.14.0, < 2.14.7>=2.15.0, < 2.15.1

Affected range stops below 2.13.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.14.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.15.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

x_refsource_CONFIRMPatchVendor Advisory

Source: cverecord

https://github.com/Icinga/icinga2/security/advisories/GHSA-v9jg-xqhj-f43g

x_refsource_MISCPatch

Source: cverecord

https://github.com/Icinga/icinga2/pull/6521

x_refsource_MISCRelease Notes

Source: cverecord

https://icinga.com/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUM[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card