NTPsec ntpd EUVD-2026-107309

Requires that the target NTPsec ntpd (versions 1.1.4 through 1.2.5) has Network Time Security (NTS) enabled and is accepting NTS requests, since the vulnerable code path parses NTS Cookie Placeholder extension fields; deployments without NTS configured are not exposed. When NTS is enabled, no authentication or user interaction is needed (PR:N/UI:N) - the attacker simply sends one NTS request with an excessive number of NTS Cookie Placeholder extension fields over the network. Limiting factors: the NTS-enabled precondition (not universal across NTPsec installs), the narrow affected version range (1.1.4-1.2.5), and the availability-only impact (crash/restart, no data exposure or code execution).

This is a genuine but bounded denial-of-service issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) and CWE-617 (Reachable Assertion/reachable exit) are internally consistent: a remote, unauthenticated attacker over the network can crash ntpd with low complexity, but there is NO confidentiality or integrity impact - the sole impact is availability (daemon termination). The 'Information Disclosure' tag in the input directly CONTRADICTS this and is incorrect; nothing in the description, CWE, or CVSS supports information disclosure. On the exploitation side, no EPSS score, no CISA KEV entry, and no POC were provided - exploitation status is 'no public exploit identified at time of analysis'. There is no SSVC decision data supplied. The real-world priority is moderated by a key precondition: the daemon must have NTS (Network Time Security) enabled to parse the malicious NTS Cookie Placeholder extension fields, so environments running NTPsec without NTS configured are not exposed. A vendor patch exists (commit df83f3c4f referenced), which lowers urgency where patching is feasible. Net: credible, easy-to-trigger DoS against a specific configuration of a niche product - patch promptly on NTS-enabled NTPsec hosts, but this is not a mass-exploitation 'drop everything' event given the availability-only impact, niche footprint, and absence of KEV/POC/EPSS signals.

An attacker able to reach an NTS-enabled NTPsec ntpd server over the network (AV:N, no authentication per PR:N) sends a single crafted NTS request containing an excessive number of NTS Cookie Placeholder extension fields. Parsing this triggers a reachable exit/assertion in ntpd, causing the daemon to terminate and denying time synchronization to all clients until it is restarted. No public exploit code was identified in the provided data, though a vendor fix commit is referenced.