CVE-2026-26076: ntpd-rs NTS DoS Vulnerability

CVE-2026-26076 Overview

CVE-2026-26076 is a resource exhaustion vulnerability in ntpd-rs, a full-featured implementation of the Network Time Protocol written in Rust. Prior to version 1.7.1, an attacker can remotely induce moderate increases (2-4 times above normal) in CPU usage by exploiting the NTS (Network Time Security) implementation. When NTS is enabled on an ntpd-rs server, an attacker can craft malformed NTS packets that request a large number of cookies, causing the server to expend significantly more computational effort processing responses.

Critical Impact

Remote attackers can degrade ntpd-rs server performance through malformed NTS packet requests, potentially affecting time synchronization services for dependent infrastructure.

Affected Products

• ntpd-rs versions prior to 1.7.1
• Systems running ntpd-rs with NTS (Network Time Security) enabled

Discovery Timeline

• February 12, 2026 - CVE-2026-26076 published to NVD
• February 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26076

Vulnerability Analysis

This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue lies in how ntpd-rs handles NTS cookie requests within incoming packets. When NTS is enabled, the server processes cookie requests as part of the NTS-KE (Key Establishment) protocol. An attacker can exploit this by crafting NTS packets that request an excessive number of cookies in a single request, forcing the server to perform cryptographic operations for each requested cookie without adequate resource limits.

The impact is a denial of service condition where CPU utilization increases moderately (2-4 times normal levels), which can degrade server performance and affect time synchronization accuracy for clients depending on the affected server. While not a complete service disruption, this degradation can be significant in environments where precise time synchronization is critical.

Root Cause

The root cause is the absence of proper resource allocation limits when processing NTS cookie requests. The server did not enforce a reasonable maximum on the number of cookies that could be requested in a single NTS packet, allowing attackers to submit requests that consume disproportionate CPU resources relative to legitimate traffic patterns.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the ntpd-rs server can send specially crafted NTS packets containing malformed cookie requests. The attack exploits the asymmetric cost between sending a malicious request (low computational cost for attacker) versus processing it (higher computational cost for server).

The vulnerability mechanism involves sending NTS packets with inflated cookie request counts. When the server attempts to generate and encrypt cookies for each request, the cryptographic operations accumulate, consuming CPU cycles. By sustaining a stream of such malformed packets, an attacker can maintain elevated CPU usage on the target server, degrading its ability to serve legitimate NTP clients.

For detailed technical information about the vulnerability and fix, see the GitHub Security Advisory GHSA-c7j7-rmvr-fjmv.

Detection Methods for CVE-2026-26076

Indicators of Compromise

• Abnormal CPU utilization spikes (2-4x normal) on ntpd-rs servers with NTS enabled
• Increased volume of NTS-KE protocol traffic from unusual sources
• NTP response latency increases for legitimate clients
• Log entries indicating malformed or unusual NTS packet processing

Detection Strategies

• Monitor CPU utilization patterns on ntpd-rs servers, alerting on sustained increases above baseline
• Implement network monitoring to detect anomalous NTS traffic volumes or patterns
• Deploy intrusion detection rules to identify NTS packets with unusually high cookie request counts
• Correlate NTP server performance metrics with incoming connection sources to identify potential attackers

Monitoring Recommendations

• Establish baseline CPU metrics for ntpd-rs processes and configure alerts for deviations
• Enable verbose logging for NTS operations to capture details about incoming requests
• Monitor network traffic to NTS-enabled ports (typically UDP 123 and TCP 4460) for volumetric anomalies
• Implement rate limiting at the network perimeter for NTP and NTS traffic

How to Mitigate CVE-2026-26076

Immediate Actions Required

• Upgrade ntpd-rs to version 1.7.1 or later immediately
• Review server configurations to identify all instances running NTS-enabled ntpd-rs
• Consider temporarily disabling NTS if upgrade cannot be performed immediately and time security is not critical
• Implement network-level rate limiting for NTP/NTS traffic as a compensating control

Patch Information

The vulnerability has been fixed in ntpd-rs version 1.7.1. The fix introduces proper limits on NTS cookie request processing to prevent resource exhaustion attacks.

• Fixed Version:1.7.1
• Release:GitHub Release v1.7.1
• Commit:fa73af14d17b666b1142b9fee3ba22c18a841d24

Workarounds

• Implement rate limiting at the network firewall or load balancer level for NTS traffic
• Temporarily disable NTS functionality if time synchronization security is not required
• Deploy ntpd-rs servers behind reverse proxies or network appliances that can filter malformed packets
• Increase server resources (CPU allocation) as a temporary measure to absorb attack impact

# Example: Rate limiting NTS traffic with iptables
# Limit NTS-KE connections to 10 per second per source IP
iptables -A INPUT -p tcp --dport 4460 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 4460 -m state --state NEW -m recent --update --seconds 1 --hitcount 10 -j DROP

# Alternative: Upgrade ntpd-rs to patched version
# Using cargo (if installed from source)
cargo install ntpd-rs --version 1.7.1