CVE-2025-61908

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-11-26

Assigner: GitHub, Inc.

Description

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. This can be used by any API user with access to an API endpoint that allows specifying a filter expression to crash the Icinga 2 daemon. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-11-26

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61908

EUVD

EUVD-2025-34793

Affected Vendors & Products

Vendor	Product	Version / Range
icinga	icinga	From 2.10.0 (inc) to 2.13.13 (exc)
icinga	icinga	From 2.14.0 (inc) to 2.14.7 (exc)
icinga	icinga	From 2.15.0 (inc) to 2.15.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability in Icinga 2 occurs when an invalid reference, such as a reference to null, is created. Dereferencing this invalid reference causes a segmentation fault, which can crash the Icinga 2 daemon. Any API user with access to an API endpoint that allows specifying a filter expression can exploit this to cause the crash.

Impact Analysis

The vulnerability can be exploited to crash the Icinga 2 daemon, leading to a denial of service. This could disrupt monitoring services and impact system availability.

Mitigation Strategies

Upgrade Icinga 2 to version 2.15.1, 2.14.7, or 2.13.13 or later, as these versions include the fix for this vulnerability.

Hi! I’m here to help you understand CVE-2025-61908. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70