Approved changes feed: RSS · Atom
cpe:2.3:a:pendulum-project:ntpd-rs:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Pendulum Project (f59d6e28-9810-5e9a-afef-d7e8093fb9de) |
|---|---|
| Product | Ntpd Rs (d3a7e320-1e93-5df3-a817-69eedbbe62c6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-26076 |
vulnerable | 2026-06-08 07:53:20.775259 |
ntpd-rs affected by excessive CPU load from malformed packets
ntpd-rs is a full-featured implementation of the Network Time Protocol. Prior to 1.7.1, an attacker can remotely induce moderate increases (2-4 times above normal) in cpu usage. When having NTS enabled on an ntpd-rs server, an attacker can create malformed NTS packets that take significantly more effort for the server to respond to by requesting a large number of cookies. This can lead to degraded server performance even when a server could otherwise handle the load. This vulnerability is fixed in 1.7.1.
Published: 2026-02-12T21:48:44.651Z
Updated: 2026-02-13T16:00:13.690Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58066 |
vulnerable | 2026-06-08 07:35:17.013552 |
DoS Vulnerability in ntpd-rs
MEDIUM (5.3)
nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. In versions between 1.2.0 and 1.6.1 inclusive servers which allow non-NTS traffic are affected by a denial of service vulnerability, where an attacker can induce a message storm between two NTP servers running ntpd-rs. Client-only configurations are not affected. Affected users are recommended to upgrade to version 1.6.2 as soon as possible.
Published: 2025-08-29T20:54:13.174Z
Updated: 2025-09-02T13:53:59.838Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38528 |
vulnerable | 2026-06-08 06:41:47.635011 |
Unlimited number of NTS-KE connections can crash ntpd-rs server
HIGH (7.5)
nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are unaffected. This vulnerability has been patched in version 1.1.3.
Published: 2024-06-28T19:28:34.664Z
Updated: 2024-08-02T04:12:25.343Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-33192 |
vulnerable | 2026-06-08 06:06:21.962878 |
Improper handling of NTS cookie length that could crash the ntpd-rs server
HIGH (7.5)
ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets. The issue was caused by improper slice indexing. The indexing operations were replaced by safer alternatives that do not crash the ntpd-rs server process but instead properly handle the error condition. A patch was released in version 0.3.3.
Published: 2023-05-27T03:53:34.506Z
Updated: 2025-01-14T18:20:44.928Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.