CVE-2026-26076: 
NixOS vulnerability analysis and mitigation

CVE-2026-26076 is a denial-of-service vulnerability in ntpd-rs, a full-featured Rust implementation of the Network Time Protocol developed by the Pendulum Project (tweedegolf). When Network Time Security (NTS) is enabled, an unauthenticated remote attacker can send malformed NTS packets requesting an excessive number of cookies, causing the server to expend significantly more CPU resources than normal. All versions of ntpd-rs prior to 1.7.1 are affected. The vulnerability was disclosed on February 12, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). When processing NTS timestamp responses, the server iterated over all NtsCookiePlaceholder extension fields in both authenticated and encrypted sections of an incoming packet without imposing any upper bound on the number of cookies generated. An attacker could craft a malformed NTS packet containing a large number of cookie placeholder fields, forcing the server to generate and encode a corresponding number of cookies per request. The fix, applied in commit fa73af1, introduces a .take(MAX_COOKIES) limit on the iterator in ntp-proto/src/packet/mod.rs to cap the number of cookies processed per packet (GitHub Commit, GitHub Advisory).

Successful exploitation causes moderate but meaningful CPU exhaustion on the affected ntpd-rs server, with observed increases of 2–4 times above normal operating levels. This degrades server performance and can impair or deny time synchronization services to legitimate clients, even on servers that would otherwise handle normal load. There is no impact on confidentiality or integrity; the vulnerability is limited to availability. Environments relying on ntpd-rs for accurate time synchronization — including those with NTS enabled for authenticated time — are at risk of service degradation (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity, making it straightforward to attempt if an attacker targets an NTS-enabled ntpd-rs server. The EPSS score is approximately 0.04%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing ntpd-rs servers with NTS enabled by scanning for NTP services (UDP port 123) and probing for NTS support via NTS Key Exchange (TCP port 4460).
2. Craft malformed NTS packet: Construct a malformed NTS client packet containing a large number of NtsCookiePlaceholder extension fields in both the authenticated and encrypted sections, far exceeding what a legitimate client would request.
3. Send packet to target: Transmit the crafted packet to the target ntpd-rs server. No authentication or prior session establishment is required.
4. Repeat to sustain load: Send the malformed packets repeatedly to maintain elevated CPU usage (2–4x normal) on the server, degrading its ability to respond to legitimate NTP/NTS clients.
5. Observe impact: Monitor for degraded time synchronization responses or increased latency from the target server, indicating successful resource exhaustion (GitHub Advisory, GitHub Commit).

• Network: Unusual volume of NTS packets arriving at UDP port 123 or NTS-KE port 4460 from a single or small set of source IPs; packets with abnormally large numbers of extension fields.
• Process/System: Sustained CPU usage on the ntpd-rs process at 2–4x above baseline without a corresponding increase in legitimate client connections.
• Logs: ntpd-rs log entries indicating repeated processing of NTS messages with excessive cookie placeholder counts; log spam related to network-triggered events (also addressed in v1.7.1).
• Metrics: Monitoring dashboards showing anomalous spikes in NTP server CPU utilization correlated with inbound NTS traffic surges (GitHub Advisory, GitHub Release).

The vulnerability is fixed in ntpd-rs version 1.7.1, released February 12, 2026. Administrators should upgrade immediately. As a temporary workaround, the advisory suggests running ntpd-rs on a machine with excess CPU capacity, since the attack only multiplies CPU usage by a factor of 2–4. Additionally, disabling NTS on the server (if not operationally required) eliminates the attack surface entirely, as the vulnerability only affects NTS-enabled deployments. Network-level rate limiting or filtering of NTS traffic from untrusted sources can also reduce exposure (GitHub Advisory, GitHub Release).

Red Hat tracked the vulnerability via Bugzilla (Bug 2439531) and published a security advisory, indicating relevance to Red Hat-distributed packages. Debian also issued a security notice referencing this CVE in March 2026, and Fedora published an update advisory. The vulnerability was reported to the Pendulum Project by a researcher identified as "lamz" and was acknowledged in the GitHub security advisory. Community reaction on GitHub was positive regarding the prompt patch release, with several users reacting to the v1.7.1 release notes (GitHub Advisory, Red Hat Bugzilla).