DEBIAN-CVE-2026-121505: Debian/ntpsec vulnerability

Q: Which systems are exposed?

NTPsec clients running a version before 1.2.4 are exposed when they process an NTS-KE response from a malicious NTS-KE server. The provided data does not state whether any default server configuration directs clients to an attacker-controlled server.

Q: What does an attacker need to exploit this?

The attacker needs to operate or control an NTS-KE server that the vulnerable client contacts. They can send an NTS-KE record whose declared length is larger than the received data.

Q: How can I determine whether a client is affected?

Check the NTPsec version used by the client. Versions before 1.2.4 are affected according to the provided data.

Published Nov 3, 2026

Updated

An out-of-bounds read in the NTS-KE client response parser (ntsclientprocessresponsecore) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.

Affected Software

3 affected componentsFixes available

debian/ntpsec*

debian/ntpsec<1.2.4+dfsg-1

1.2.4+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ntpsec to a version that resolves this vulnerability.
Fixed in 1.2.4+dfsg-1

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed?

NTPsec clients running a version before 1.2.4 are exposed when they process an NTS-KE response from a malicious NTS-KE server. The provided data does not state whether any default server configuration directs clients to an attacker-controlled server.

What does an attacker need to exploit this?

The attacker needs to operate or control an NTS-KE server that the vulnerable client contacts. They can send an NTS-KE record whose declared length is larger than the received data.

How can I determine whether a client is affected?

Check the NTPsec version used by the client. Versions before 1.2.4 are affected according to the provided data.

DEBIAN-CVE-2026-121505: Debian/ntpsec vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this?

How can I determine whether a client is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this?

How can I determine whether a client is affected?