{"id":"CVE-2026-102486","kind":"vulnerability","aliases":["CVE-2026-102486"],"related":[],"title":"NTPsec ntpd: oversized NTS nonce field lets remote attackers crash the daemon","description":"Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.","summary":"NTPsec ntpd versions 1.1.4 through 1.2.5 read past the end of a buffer when parsing NTS Authenticator and Encrypted Extension Fields. A remote attacker can send a packet with an oversized nonce length to crash the daemon.","severity":"high","cvss":7.5,"epss":0.0075,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","ntp","ntpsec","runtime","self-hosted"],"not_affected_if":["other-ntp-implementation","version-outside-range"],"how_to_check":"- Run `ntpd --version` or `ntpq -c version` on each host running NTPsec and compare against the affected range 1.1.4 through 1.2.5.\n- Check whether NTS is enabled in the NTP configuration (`nts` directives in `ntp.conf`); the sources do not say whether the flaw requires NTS to be configured.","fix":"- Upgrade NTPsec to a release later than `1.2.5`; the sources do not name the fixed version.\n- Until patched, restrict which networks can reach the NTP service port (UDP `123`) where possible.","status":"open","published_at":"2026-10-21T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:46+00:00","updated_at":"2026-10-25T03:16:46+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:16:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NTPsec to a release later than `1.2.5`; the sources do not name the fixed version.\n- Until patched, restrict which networks can reach the NTP service port (UDP `123`) where possible.","reach":"network","title":"NTPsec ntpd: oversized NTS nonce field lets remote attackers crash the daemon","impact":"low","summary":"NTPsec ntpd versions 1.1.4 through 1.2.5 read past the end of a buffer when parsing NTS Authenticator and Encrypted Extension Fields. A remote attacker can send a packet with an oversized nonce length to crash the daemon.","category":"runtime","nicknames":[],"who_cares":["ntpsec","ntp","linux","self-hosted","infrastructure"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker crashes the ntpd daemon, stopping time sync","analyst_note":"Confirm the fixed NTPsec version and whether NTS must be enabled for the flaw to be reachable; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-102486.","how_to_check":"- Run `ntpd --version` or `ntpq -c version` on each host running NTPsec and compare against the affected range 1.1.4 through 1.2.5.\n- Check whether NTS is enabled in the NTP configuration (`nts` directives in `ntp.conf`); the sources do not say whether the flaw requires NTS to be configured.","needs_analyst":true,"not_affected_if":["other-ntp-implementation","version-outside-range"],"who_is_affected":"Hosts running NTPsec ntpd between versions 1.1.4 and 1.2.5 that accept NTP traffic from networks an attacker can reach. The sources do not say whether NTS must be enabled, so systems on those versions should be treated as exposed. Hosts running other NTP implementations or NTPsec outside that range are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":3371,"output_tokens":714,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102486':15A,18A '-2026':14A,17A '1.1.4':30B,77C '1.2.5':32B,79C 'aeef':96C 'allow':80C 'attack':9A,50B,83C 'authent':43B,91C 'bound':67C 'buffer':39B 'crash':10A,61B,85C 'cve':13A,16A 'daemon':12A,63B,87C 'encrypt':45B,93C 'end':36B 'extens':46B,71C,94C 'field':6A,47B,72C,95C,97C 'host':26B 'infrastructur':19B 'length':59B,102C 'let':7A 'linux':20B 'nonc':5A,58B,101C 'ntp':21B 'ntpd':2A,28B,76C 'ntpsec':1A,22B,27B,75C 'nts':4A,42B,70C,90C 'out-of-bound':64C 'overs':3A,57B,100C 'packet':54B 'pars':41B,73C 'past':34B 'read':33B,68C 'remot':8A,49B,82C 'runtim':23B 'self':25B 'self-host':24B 'send':52B 'version':29B 'via':88C","nicknames":[],"mitigations":[],"who_affected":"Hosts running NTPsec ntpd between versions 1.1.4 and 1.2.5 that accept NTP traffic from networks an attacker can reach. The sources do not say whether NTS must be enabled, so systems on those versions should be treated as exposed. Hosts running other NTP implementations or NTPsec outside that range are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102486","severity":null,"published_at":"2026-10-21T16:17:14+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-102486","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102486","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}