Quick answers
- Is CVE-2026-102483 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-102483 being exploited in the wild.
- How severe is CVE-2026-102483?
- High severity, with a CVSS score of 7.5, published 21 October 2026.
- Which products and versions are affected?
- Ntpsec Ntpd 1.1.4 through 1.2.5.
- Is there a fix for CVE-2026-102483?
- Yes: fixed in ntpd 1.2.6 or later (fix committed September 14, 2026). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-102483 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-102483?
- Check whether you run Ntpsec Ntpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: ntpd 1.2.6 or later (fix committed September 14, 2026)
Technical details
The vulnerability is a reachable exit condition in NTPsec ntpd versions 1.1.4 through 1.2.5 in the NTS extension handling code. The flaw stems from two bugs: an incorrect length validation check for CookiePlaceholders that would accept zero-length placeholders, and the absence of a limit on the number of CookiePlaceholders processed, allowing an attacker to trigger an unhandled condition when the daemon attempts to send back more cookies than can fit in a response. A remote network attacker can exploit this without authentication by sending a crafted NTS request.
Affected products
- NTPsec ntpd 1.1.4 through 1.2.5
Timeline
- 2026-10-21: disclosed