CVE-2025-58066

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. In versions between 1.2.0 and 1.6.1 inclusive servers which allow non-NTS traffic are affected by a denial of service vulnerability, where an attacker can induce a message storm between two NTP servers running ntpd-rs. Client-only configurations are not affected. Affected users are recommended to upgrade to version 1.6.2 as soon as possible.

Scoring

Severity

MEDIUM

CVSS base score

5.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS probability

0.33%

CWE

CWE-406

Published

2025-08-29

Last modified

2026-03-13

Affected products

• pendulum-project ntpd-rs

Weakness type

• CWE-406

Related vulnerabilities

• CVE-2026-86202 — PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket
• CVE-2026-68080 — Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service
• CVE-2026-54609 — QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
• CVE-2026-50045 — 'max-global-quota' reset by DNSSEC validation restarts
• CVE-2026-45557 — Technitium DNS Server excessive DNSSEC requests
• CVE-2021-38135 — Possible External service interaction Vulnerability in OpenText iManager
• CVE-2024-25015 — IBM MQ denial of service
• CVE-2014-125036 — drybjed ansible-ntp main.yml amplification

Markdown version · Browse all CVEs