CVE-2026-26076
📋 TL;DR
This vulnerability allows remote attackers to cause moderate CPU usage spikes (2-4 times normal) on ntpd-rs servers with NTS enabled by sending malformed packets requesting excessive cookies. This can degrade server performance even under normal load conditions. Only ntpd-rs servers with NTS enabled are affected.
💻 Affected Systems
- ntpd-rs
📦 What is this software?
Ntpd Rs by Tweedegolf
⚠️ Risk & Real-World Impact
Worst Case
Sustained CPU exhaustion leading to service degradation, potential time synchronization failures, and cascading effects on dependent services.
Likely Case
Moderate performance degradation with increased CPU usage affecting time synchronization accuracy during attack periods.
If Mitigated
Minimal impact with proper rate limiting, monitoring, and network segmentation in place.
🎯 Exploit Status
Attack requires NTS to be enabled and involves sending specially crafted packets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.1
Vendor Advisory: https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-c7j7-rmvr-fjmv
Restart Required: Yes
Instructions:
1. Stop ntpd-rs service. 2. Update to version 1.7.1 or later. 3. Restart ntpd-rs service.
🔧 Temporary Workarounds
Disable NTS
allTemporarily disable Network Time Security if not required
Edit ntpd-rs configuration to disable NTS
Implement rate limiting
allConfigure network-level rate limiting for NTS packets
🧯 If You Can't Patch
- Disable NTS functionality if not required
- Implement strict network segmentation and firewall rules to limit NTS traffic to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check if running ntpd-rs version <1.7.1 with NTS enabled in configurationCheck Version:
ntp-ctl --versionVerify Fix Applied:
Verify ntpd-rs version is 1.7.1 or later and NTS is properly configured📡 Detection & Monitoring
Log Indicators:
- Unusual NTS cookie request patterns
- CPU usage spikes in system logs
- Increased error rates in ntpd-rs logs
Network Indicators:
- High volume of NTS packets from single sources
- Malformed NTS packet patterns
SIEM Query:
source="ntpd-rs" AND ("NTS" OR "cookie") AND (error OR warning)