CVE-2025-61908 Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference
HighCVSS 7.1
EPSS 0.55%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. This can be used by any API user with access to an API endpoint that allows specifying a filter expression to crash the Icinga 2 daemon. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/icinga2(Debian:12) | All versions | No fix listed |
| debian/icinga2(Debian:12) | = 2.13.6-2 | No fix listed |
| debian/icinga2(Debian:12) | = 2.13.6-2+deb12u1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.13.6-2+deb12u2 | No fix listed |
| debian/icinga2(Debian:12) | = 2.13.7-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.13.7-1~exp1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.13.8-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.14.0-1~exp1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.14.1-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.14.2-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.14.2-1+loong64 | No fix listed |
| debian/icinga2(Debian:12) | = 2.14.3-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.14.4-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.14.5-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.14.6-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.15.0-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.15.0-1~exp1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.15.1-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.15.2-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.15.2-2 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.0-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.0-2 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.0-3~exp1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.0-3~exp2 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.0-3~exp3 | No fix listed |
Show 23 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/icinga2(Debian:12) | = 2.16.0-3~exp4 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.1-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.1-1~exp1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.2-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.2-2 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.3-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.4-1 | No fix listed |
| debian/icinga2(Debian:12) | = 2.16.5-1 | No fix listed |
| debian/icinga2(Debian:13) | < 2.14.6-1+deb13u1 | 2.14.6-1+deb13u1 |
| debian/icinga2(Debian:13) | = 2.14.6-1 | No fix listed |
| debian/icinga2(Debian:14) | < 2.15.1-1 | 2.15.1-1 |
| debian/icinga2(Debian:14) | = 2.14.6-1 | No fix listed |
| debian/icinga2(Debian:14) | = 2.15.0-1 | No fix listed |
| debian/icinga2(Debian:14) | = 2.15.0-1~exp1 | No fix listed |
| icinga2 | = >=2.10.0, < 2.13.13 | No fix listed |
| icinga2 | = >=2.14.0, < 2.14.7 | No fix listed |
| icinga2 | = >=2.15.0, < 2.15.1 | No fix listed |
| ubuntu/icinga2(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/icinga2(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/icinga2(Ubuntu:26.04) | All versions | No fix listed |
| icinga | >= 2.10.0, < 2.13.13 | 2.13.13 |
| icinga | >= 2.14.0, < 2.14.7 | 2.14.7 |
| icinga | >= 2.15.0, < 2.15.1 | 2.15.1 |
References
- Debian Security Tracker CVE-2025-61908 vendor-advisory
- https://github.com/Icinga/icinga2/security/advisories/GHSA-v9jg-xqhj-f43g patch vendor-advisory
- https://github.com/Icinga/icinga2/pull/6521 patch
- https://icinga.com/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4 release-notes
- Ubuntu CVE tracker vendor-advisory
- www.cve.org