CVE-2025-61908: high-severity vulnerability in icinga2
Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.6%
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. This can be used by any API user with access to an API endpoint that allows specifying a filter expression to crash the Icinga 2 daemon. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
Icinga · icinga2Related CVEs — icinga2
In the same product, most dangerous first.
CVE-2024-49369CRITICALIcinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API ConnectionsEPSS 2.9%CVE-2021-32743HIGHPasswords used to access external services inadvertently exposed through APIEPSS 1.8%CVE-2021-37698HIGHMissing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2WriterEPSS 1.4%CVE-2021-32739HIGHResults of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identitiesEPSS 1.1%CVE-2026-61551HIGHIcinga 2: Stack overflow via deeply nested JSON objectsEPSS 0.9%CVE-2026-61552HIGHIcinga 2 DSL Injection via Unescaped Import Template NameEPSS 0.9%