CVE-2025-61908: Icinga 2 Denial of Service Vulnerability

CVE-2025-61908 Overview

CVE-2025-61908 is a null pointer dereference vulnerability [CWE-476] in Icinga 2, an open source monitoring system. The flaw affects versions from 2.10.0 up to (but not including) 2.15.1, 2.14.7, and 2.13.13. When Icinga 2 creates an invalid reference, such as a reference to null, dereferencing that value produces a segmentation fault. Any authenticated API user with access to an endpoint that accepts a filter expression can trigger the crash and terminate the Icinga 2 daemon. The maintainers shipped fixes in Icinga 2 2.15.1, 2.14.7, and 2.13.13.

Critical Impact
A low-privileged API user can remotely crash the Icinga 2 monitoring daemon by submitting a crafted filter expression, disrupting monitoring and alerting for the affected infrastructure.

Affected Products

Icinga 2 versions 2.10.0 through 2.13.12
Icinga 2 versions 2.14.0 through 2.14.6
Icinga 2 version 2.15.0

Discovery Timeline

2025-10-16 - CVE-2025-61908 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61908

Vulnerability Analysis

Icinga 2 exposes a REST API that accepts filter expressions written in the Icinga DSL. Several endpoints evaluate these expressions to select monitored objects. The filter parser and evaluator construct references to internal values during expression evaluation. The daemon fails to validate whether a constructed reference points to a valid object before dereferencing it. When the reference resolves to null, the dereference operation triggers a segmentation fault that terminates the entire Icinga 2 process.

Because the daemon handles all monitoring, notifications, and API traffic in a single process, the crash halts every monitoring function until the service restarts. An attacker can repeatedly send the crafted request to keep the daemon offline. The vulnerability requires authentication but only a low-privileged API account, and no user interaction is needed.

Root Cause

The root cause is missing validation of reference targets before dereferencing them inside the filter expression evaluator [CWE-476]. The evaluator assumes references produced during expression parsing always point to valid values, so it dereferences them without a null check. Crafted expressions that build a reference to null bypass this assumption and reach the unchecked dereference path.

Attack Vector

Exploitation occurs over the network against the Icinga 2 API, typically exposed on TCP port 5665. The attacker authenticates with any API user that has permission to call an endpoint accepting a filter parameter, such as object query endpoints. The attacker submits a filter expression that constructs a null reference and forces dereferencing. The daemon crashes with SIGSEGV, producing a denial-of-service condition. See the GitHub Security Advisory GHSA-v9jg-xqhj-f43g for technical details.

Detection Methods for CVE-2025-61908

Indicators of Compromise

Unexpected termination of the icinga2 daemon with SIGSEGV entries in /var/log/icinga2/icinga2.log or system journal.
Core dumps referencing the Icinga 2 filter evaluation code path.
Repeated API requests to endpoints such as /v1/objects/* containing unusual filter expressions from a single authenticated user.

Detection Strategies

Monitor systemd service state for repeated restarts of the icinga2 unit and correlate with recent API activity.
Enable Icinga 2 API access logging and inspect POST/GET bodies containing filter parameters for malformed or unusual DSL constructs.
Alert on API error responses immediately followed by service disconnection or client reconnection storms.

Monitoring Recommendations

Ship Icinga 2 daemon logs and system journal entries to a centralized log platform for retention and correlation.
Track the number of authenticated API sessions per user and flag low-privilege accounts issuing high volumes of filter queries.
Baseline normal icinga2 process uptime and alert on unplanned restarts.

How to Mitigate CVE-2025-61908

Immediate Actions Required

Upgrade Icinga 2 to 2.15.1, 2.14.7, or 2.13.13 on all monitoring masters, satellites, and clients running an affected version.
Restrict API access to trusted management networks using firewall rules or a reverse proxy allowlist on TCP 5665.
Audit Icinga 2 ApiUser objects and remove or rotate credentials for accounts that do not require filter-capable endpoints.

Patch Information

The Icinga project released fixes in Icinga 2 2.15.1, 2.14.7, and 2.13.13. Details and release notes are available in the Icinga release announcement and the corresponding GitHub Pull Request. Package updates are available through the official Icinga repositories for supported Linux distributions.

Workarounds

Limit ApiUser permissions to only the object types and actions that operators require, avoiding wildcard grants that expose filter-capable endpoints.
Place the Icinga 2 API behind an authenticating reverse proxy that inspects and rejects requests containing suspicious filter payloads.
Configure systemd with automatic restart on failure to reduce downtime while patching, using Restart=on-failure and a short RestartSec value.

bash

# Configuration example: restrict Icinga 2 API access via firewall
sudo firewall-cmd --permanent --zone=internal --add-source=10.0.0.0/24
sudo firewall-cmd --permanent --zone=internal --add-port=5665/tcp
sudo firewall-cmd --permanent --zone=public --remove-port=5665/tcp
sudo firewall-cmd --reload

# Verify installed Icinga 2 version after upgrade
icinga2 --version