CVE-2026-26076
High
Description
ntpd-rs is a full-featured implementation of the Network Time Protocol. Prior to 1.7.1, an attacker can remotely induce moderate increases (2-4 times above normal) in cpu usage. When having NTS enabled on an ntpd-rs server, an attacker can create malformed NTS packets that take significantly more effort for the server to respond to by requesting a large number of cookies. This can lead to degraded server performance even when a server could otherwise handle the load. This vulnerability is fixed in 1.7.1.
SeverityHigh
CVSS7.5
Exploit probability—
ProductTweedegolf Ntpd-rs
PublishedFeb 12, 2026
First seenFeb 12, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- tweedegolf ntpd-rs1.7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tweedegolf ntpd-rs | v < 1.7.1 | 1.7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.