Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference
Priority LOW 32CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.
Summary
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. This can be used by any API user with access to an API endpoint that allows specifying a filter expression to crash the Icinga 2 daemon. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00551 46th percentileScored 2026-11-07
Fix Fixed icinga2 (Icinga): 2.13.13, 2.14.7, 2.15.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Icinga | icinga2 | 2.10.0 to before 2.13.13; 2.14.0 to before 2.14.7; 2.15.0 to before 2.15.1 | 2.13.13, 2.14.7, 2.15.1 | Patch available | CNA |
- icinga2 VendorIcinga Affected 2.10.0 to before 2.13.13; 2.14.0 to before 2.14.7; 2.15.0 to before 2.15.1 Fixed in 2.13.13, 2.14.7, 2.15.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:* | 2.10.0 to before 2.13.13; 2.14.0 to before 2.14.7; 2.15.0 to before 2.15.1 | Vulnerable | Icinga |
- cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:* Versions 2.10.0 to before 2.13.13; 2.14.0 to before 2.14.7; 2.15.0 to before 2.15.1 Vulnerable ·Icinga
Remediation
- Fix · CNA icinga2 (Icinga) Fixed in 2.13.13, 2.14.7, 2.15.1
Timeline
- 2026-10-02 Threatist record created from CVE-2025-61908
References
More Icinga vulnerabilities
- TI-2024-16337 Icinga Director configuration is susceptible to Cross-Site Request Forgery CVSS 3.1HIGH 8.3
- TI-2012-05060 Multiple stack-based buffer overflows in the get_history function in history.cgi in… CVSS 2.0HIGH 7.5
- TI-2013-05840 Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before… CVSS 2.0MEDIUM 5.5
- TI-2024-32957 Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections CVSS 3.1CRITICAL 9.8
- TI-2025-30428 Icinga 2 certificate renewal might incorrectly renew an invalid certificate CVSS 4.0CRITICAL 9.3
- TI-2021-12411 Passwords used to access external services inadvertently exposed through API CVSS 3.1HIGH 8.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences