CVE-2026-102483: Reachable Assertion in ntpsec

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-21 · updated 2026-10-29
Weakness: CWE-617

Description

Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.

Affected products

ntpsec: from 1.1.4 before 1.2.6 — fixed in 1.2.6

How to fix

Upgrade to a fixed version: ntpsec 1.2.6. Check the vendor advisory for mitigations.

References

https://gitlab.com/NTPsec/ntpsec/-/commit/df83f3c4f
https://gitlab.com/NTPsec/ntpsec/-/work_items/899

Get alerted when CVE-2026-102483 or the next vulnerability affects your stack