Approved changes feed: RSS · Atom
cpe:2.3:a:tweedegolf:ntpd-rs:*:*:*:*:*:rust:*:*part: a version: * update: *
| Vendor | Tweedegolf (5035864a-1000-5a87-8247-51177461a253) |
|---|---|
| Product | Ntpd Rs (a0fb72d3-a86e-50c9-9869-7b4b49ee7e76) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | rust |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pendulum-project/ntpd-rs |
purl2cpe | 2026-06-01 10:12:33.835686 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-26076 |
vulnerable | 2026-06-08 07:53:20.776316 |
ntpd-rs affected by excessive CPU load from malformed packets
ntpd-rs is a full-featured implementation of the Network Time Protocol. Prior to 1.7.1, an attacker can remotely induce moderate increases (2-4 times above normal) in cpu usage. When having NTS enabled on an ntpd-rs server, an attacker can create malformed NTS packets that take significantly more effort for the server to respond to by requesting a large number of cookies. This can lead to degraded server performance even when a server could otherwise handle the load. This vulnerability is fixed in 1.7.1.
Published: 2026-02-12T21:48:44.651Z
Updated: 2026-02-13T16:00:13.690Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-33192 |
vulnerable | 2026-06-08 06:06:21.963797 |
Improper handling of NTS cookie length that could crash the ntpd-rs server
HIGH (7.5)
ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets. The issue was caused by improper slice indexing. The indexing operations were replaced by safer alternatives that do not crash the ntpd-rs server process but instead properly handle the error condition. A patch was released in version 0.3.3.
Published: 2023-05-27T03:53:34.506Z
Updated: 2025-01-14T18:20:44.928Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.