CVE-2023-3036: Out of Bounds Slice index in cfnts leads to remote panic

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-14 · updated 2026-06-17
Weakness: CWE-119

Description

An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71 enabled a remote attacker to trigger a panic by sending an NTSAuthenticator packet with extension length longer than the packet contents.

Affected products

Cloudflare Cfnts: before 2023-06-01 — fixed in 2023-06-01

How to fix

Upgrade to a fixed version: Cloudflare Cfnts 2023-06-01. Check the vendor advisory for mitigations.

References

https://github.com/cloudflare/cfnts/security/advisories/GHSA-pwx6-gw47-96cp
https://github.com/cloudflare/cfnts/security/advisories/GHSA-pwx6-gw47-96cp

Get alerted when CVE-2023-3036 or the next vulnerability affects your stack