CVE-2025-58066: ntpd-rs NTP Server DoS Vulnerability

CVE-2025-58066 Overview

CVE-2025-58066 is a denial of service vulnerability in ntpd-rs, a Rust implementation of the Network Time Protocol (NTP) and Network Time Security (NTS) protocols maintained by the Pendulum Project. Affected versions include 1.2.0 through 1.6.1 inclusive. Servers configured to accept non-NTS traffic can be tricked into exchanging an unbounded stream of packets with another ntpd-rs server, producing a self-sustaining message storm between the two hosts. Client-only deployments are not affected. The maintainers released version 1.6.2 to resolve the issue.

Critical Impact
An unauthenticated network attacker can trigger a sustained packet storm between two ntpd-rs servers, consuming network and CPU resources on both hosts and disrupting time synchronization services.

Affected Products

ntpd-rs 1.2.0 through 1.6.1 (inclusive) running as a server accepting non-NTS traffic
Pendulum Project ntpd-rs distributions bundling the affected versions
Downstream operating system packages that ship ntpd-rs in the vulnerable range

Discovery Timeline

2025-08-29 - CVE-2025-58066 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58066

Vulnerability Analysis

The vulnerability is classified under [CWE-406] Insufficient Control of Network Message Volume (Network Amplification). ntpd-rs server logic accepted and responded to any well-formed NTP packet, including packets whose association mode was itself a server response. An attacker can spoof a single crafted NTP packet with the source address of a second ntpd-rs server and send it to a first ntpd-rs server. The first server replies, the second server replies to that reply, and the exchange never terminates. The result is a network amplification loop between two legitimate infrastructure hosts, without requiring any authentication or user interaction.

Root Cause

The server code path in ntp-proto/src/server.rs deserialized incoming packets and generated responses without validating that the packet's association mode was Client. Server-mode, symmetric-mode, and control-mode packets were treated as if they required a response. Because two ntpd-rs servers each accepted the other's response as a valid trigger, the packet exchange became self-sustaining once initiated by a single spoofed datagram.

Attack Vector

Exploitation requires the ability to send a User Datagram Protocol (UDP) packet to an ntpd-rs server with a spoofed source address matching another ntpd-rs server. The attack is remote, unauthenticated, and requires no user interaction. Only deployments that accept non-NTS traffic are exposed. Clients that only issue outbound queries are unaffected because the vulnerable request-handling path is never reached.

rust

// Patch excerpt from ntp-proto/src/server.rs
// Ensures the server only responds to Client-mode NTP requests

// Try and parse the message
let (packet, cookie) = match NtpPacket::deserialize(message, self.keyset.as_ref()) {
-    Ok(packet) => packet,
+    Ok((packet, cookie)) => match packet.mode() {
+        crate::NtpAssociationMode::Client => (packet, cookie),
+        _ => {
+            stats_handler.register(
+                fallback_message_version(message),
+                false,
+                ServerReason::ParseError,
+                ServerResponse::Ignore,
+            );
+            return ServerAction::Ignore;
+        }
+    },
    Err(PacketParsingError::DecryptError(packet)) => {
        // Don't care about decryption errors when denying anyway
        if action != ServerResponse::Deny {

Source: ntpd-rs commit da37cf16

Detection Methods for CVE-2025-58066

Indicators of Compromise

Sustained high-rate UDP traffic on port 123 between two hosts running ntpd-rs, particularly symmetric packet flows with no legitimate polling schedule
Sudden increase in CPU utilization on ntpd-rs server processes without corresponding legitimate client growth
NTP server statistics showing large volumes of processed packets with server- or symmetric-mode associations rather than client mode

Detection Strategies

Baseline the normal packet-per-second rate to and from each NTP server and alert on deviations exceeding expected polling intervals
Inspect NetFlow or packet capture data for bidirectional UDP/123 flows where both endpoints are known NTP servers rather than clients
Correlate ntpd-rs version fingerprints from configuration management tools against the vulnerable 1.2.0 through 1.6.1 range

Monitoring Recommendations

Enable and forward ntpd-rs server statistics to a central logging platform to track packet-mode distributions over time
Add network detection rules for asymmetric-to-symmetric UDP/123 flow transitions between infrastructure hosts
Monitor upstream and peer NTP servers for reciprocal traffic patterns that indicate an active loop

How to Mitigate CVE-2025-58066

Immediate Actions Required

Upgrade all ntpd-rs server deployments to version 1.6.2 or later
Inventory hosts running ntpd-rs and confirm whether any operate as servers accepting non-NTS traffic
Apply ingress filtering on UDP port 123 to block spoofed source addresses at network boundaries (BCP 38)

Patch Information

The fix is delivered in ntpd-rs version 1.6.2. The corrective change in ntp-proto/src/server.rs verifies that the parsed packet's NtpAssociationMode equals Client before generating a response, and ignores server-mode or symmetric-mode packets. Details are available in the GitHub Security Advisory GHSA-4855-q42w-5vr4 and the upstream commit da37cf16.

Workarounds

Restrict server exposure to NTS-only traffic where deployment permits, since non-NTS acceptance is the precondition for exploitation
Convert non-essential ntpd-rs server instances to client-only configurations until the patched version is deployed
Apply firewall rules restricting UDP/123 to known legitimate client subnets and drop packets sourced from other NTP server addresses

bash

# Upgrade ntpd-rs on Debian/Ubuntu-based systems
sudo apt update
sudo apt install --only-upgrade ntpd-rs
ntp-ctl status | grep -i version   # Confirm version >= 1.6.2

# Optional: restrict UDP/123 ingress to trusted client ranges
sudo iptables -A INPUT -p udp --dport 123 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 123 -j DROP