CVE catalog

CVE-2026-26076

DEBIAN-CVE-2026-26076

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.41% · Oct 25, 2026

ntpd-rs is a full-featured implementation of the Network Time Protocol. Prior to 1.7.1, an attacker can remotely induce moderate increases (2-4 times above normal) in cpu usage. When having NTS enabled on an ntpd-rs server, an attacker can create malformed NTS packets that take significantly more effort for the server to respond to by requesting a large number of cookies. This can lead to degraded server performance even when a server could otherwise handle the load. This vulnerability is fixed in 1.7.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-ntp-proto131.4.0-4vulnerable
Debianrust-ntp-proto131.4.0-4+deb13u1fixed
Debianrust-ntp-proto141.4.0-4vulnerable
Debianrust-ntp-proto141.6.0-1vulnerable
Debianrust-ntp-proto141.6.2-1vulnerable
Debianrust-ntp-proto141.6.2-2vulnerable
Debianrust-ntp-proto141.6.2-3vulnerable
Debianrust-ntp-proto141.6.2-4vulnerable
Debianrust-ntp-proto141.7.1-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-ntp-protodeb131.4.0-4+deb13u1Not reportedDEBIAN-CVE-2026-26076Not reported
Debianrust-ntp-protodeb141.7.1-1Not reportedDEBIAN-CVE-2026-26076Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [librust-ntp-proto-dev]Fixed

    Source package: [rust-ntp-proto]

    Details (2)

    • 1.4.0-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.4.0-4+deb13u1

      pypi · rust-ntp-proto · debian · 13

    • 1.4.0-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.4.0-4+deb13u1

      pypi · rust-ntp-proto · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]