Read the docs
TI-2026-78847 Aliases CVE-2026-102483GHSA-6xg3-q93h-wcgv

Reachable assertion in NTPsec lets remote attackers terminate ntpd

Priority LOW 39CWE-617Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-617.

Summary

NTPsec ntpd versions from 1.1.4 before 1.2.6 are affected. A reachable assertion (CWE-617) makes the daemon exit when it processes an NTS request with excess NTS Cookie Placeholder extension fields. A remote attacker who needs no privileges or user interaction can terminate the daemon by sending such a request.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Fix Fixed ntpsec (NTPsec): 1.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NTPsecntpsec1.1.4 to before 1.2.61.2.6Patch availableCNA
  • ntpsec VendorNTPsec Affected 1.1.4 to before 1.2.6 Fixed in 1.2.6 Patch available CNA

Remediation

Upgrade ntpsec to version 1.2.6, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ntpsec (NTPsec) Fixed in 1.2.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ntpsec 1.2.6

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-78850 Out-of-bounds read in NTPsec ntpd NTS extension field parsingPriority MEDIUM 40
    • TI-2026-78848 Heap-based buffer overflow in NTPsec JJY refclock driverPriority LOW 28
    • TI-2026-78849 Out-of-bounds read in NTPsec ntpd Motorola Oncore driverPriority LOW 23
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-102483
  2. 2026-10-21 Alias added: GHSA-6xg3-q93h-wcgv
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Other 2

  • TI-2019-04513 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0CRITICAL 9.1
  • TI-2019-04514 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0CRITICAL 9.1
  • TI-2026-42067 gpsd gpsprof Command Injection via gnuplot plot title subtype field CVSS 4.0HIGH 8.4
  • TI-2019-04515 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0MEDIUM 6.5
  • TI-2019-04512 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0MEDIUM 6.5
  • TI-2026-78850 Out-of-bounds read in NTPsec ntpd NTS extension field parsing CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences