Description
nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are unaffected. This vulnerability has been patched in version 1.1.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pendulum-project | ntpd-rs | >= 0.3.1, <= 1.1.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-ntpd | 1.1.3-1 | — |
| Debian 13 | rust-ntpd | 1.1.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | rust-ntpd | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | ntpd-rs | 1.2.3-bp156.2.1 | openSUSE-SU-2024:0300-1 |
| SUSE Package Hub 15 SP5 | ntpd-rs | 1.2.3-bp155.2.1 | openSUSE-SU-2024:0331-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ntpd-rs | 1.2.0-1.1 | openSUSE-SU-2024:14194-1 |
| openSUSE Leap 15.6 | ntpd-rs | 1.2.3-bp156.2.1 | openSUSE-SU-2024:0300-1 |
| openSUSE Leap 15.5 | ntpd-rs | 1.2.3-bp155.2.1 | openSUSE-SU-2024:0331-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | ntpd | >= 0.3.1, < 1.1.3 | 1.1.3 | GHSA-2xpx-vcmq-5f72 |
Advisories 3
- openSUSE-SU-2024:0331-1 Security update for ntpd-rs SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14194-1 ntpd-rs-1.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0300-1 Security update for ntpd-rs SUSE / openSUSE Security Updates · Feb 4, 2026