Description
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Service Termination)
Action: Patch
AI Analysis

Impact

The vulnerability is a reachable assertion (CWE-617) in the NTPsec ntpd service that allows a remote attacker to send an NTS request containing excess NTS Cookie Placeholder extension fields, causing the daemon to exit and terminating the NTP service. This results in a denial of service affecting the availability of time synchronization for clients, with no direct compromise of confidentiality or integrity.

Affected Systems

Affected systems are the NTPsec ntpsec daemon versions 1.1.4 through 1.2.5.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity risk. EPSS is not available and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is network‑based, exploiting a remote attacker’s ability to send a crafted NTS request to a publicly reachable NTP service, making it potentially exploitable by any adversary with network access to the target host.

Generated by OpenCVE AI on October 22, 2026 at 02:03 UTC.

Remediation

Vendor Solution

Upgrade to version 1.2.6

OpenCVE Recommended Actions

  • Upgrade the NTPsec ntpd to version 1.2.6 or later.
  • Restrict inbound NTP traffic to trusted hosts using firewall rules, limiting exposure to malicious NTS requests.
  • Monitor NTP service logs and network traffic for anomalous NTS requests, and promptly respond to any identified attempts.

Generated by OpenCVE AI on October 22, 2026 at 02:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Ntpsec
Ntpsec ntpsec
Vendors & Products Ntpsec
Ntpsec ntpsec

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.
Title Reachable Assertion in ntpsec
Weaknesses CWE-617
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ntpsec Ntpsec
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-29T20:57:11.825Z

Reserved: 2026-09-29T09:30:03.160Z

Link: CVE-2026-102483

cve-icon Vulnrichment

Updated: 2026-10-29T18:34:55.431Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T16:17:13.910

Modified: 2026-10-29T21:17:07.787

Link: CVE-2026-102483

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T02:15:15Z

Weaknesses