https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:07:00.989618+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-251594 EUVD-2026-251594 2026-10-02T11:07:01.054479+00:00 EUVD-2026-251594 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58066 fkie_cve-2025-58066 2026-10-02T11:07:01.054515+00:00

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. In versions between 1.2.0 and 1.6.1 inclusive servers which allow non-NTS traffic are affected by a denial of service vulnerability, where an attacker can induce a message storm between two NTP servers running ntpd-rs. Client-only configurations are not affected. Affected users are recommended to upgrade to version 1.6.2 as soon as possible.

 https://cve.radiocsirt.org/vuln/ghsa-4855-q42w-5vr4 GHSA-4855-q42w-5vr4 — DoS Vulnerability in ntpd-rs 2026-10-02T11:07:01.054551+00:00

Affected: crates.io: ntpd-rs

# Summary

A denial of service vulnerability was discovered in ntpd-rs where an attacker can induce a message storm between two NTP servers running ntpd-rs.

# Details

Since ntpd-rs version 1.2.0, when configured as a server, incorrectly responded to all NTP messages sent to the server's port with a time reply, including to responses from other servers. As a consequence, a message with a spoofed IP address of another server could cause two servers running ntpd-rs to continually respond to each other, consuming significant amounts of resources.

# Impact

Any time server running ntpd-rs with version between 1.2.0 and 1.6.1 inclusive which allows non-NTS traffic is affected. Client-only configurations are not affected. Affected users are recommended to upgrade to version 1.6.2 as soon as possible.

# Workarounds

Should upgrading not be possible, the impact of the issue can be mitigated by: - Whitelisting access to only IP addresses of clients using the server, using the ignore filter method. - Blocking incoming non-request traffic on the NTP server port using a firewall. - Disabling public access to the vulnerable NTP server - Disabling the server functionality by removing any [server] sections from the configuration.

# Acknowledgements

The ntpd-rs authors thank Eric Sesterhenn from X41 D-Sec GmbH for finding and reporting this issue.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-58066 UBUNTU-CVE-2025-58066 2026-10-02T11:07:01.054590+00:00

Affected: Ubuntu:24.04:LTS: rust-ntpd, Ubuntu:25.10: rust-ntpd, Ubuntu:26.04:LTS: rust-ntpd

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. In versions between 1.2.0 and 1.6.1 inclusive servers which allow non-NTS traffic are affected by a denial of service vulnerability, where an attacker can induce a message storm between two NTP servers running ntpd-rs. Client-only configurations are not affected. Affected users are recommended to upgrade to version 1.6.2 as soon as possible.