CVE-2025-58066

published 2025-08-29

CVE-2025-58066: nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. In versions between 1.2.0 and 1.6.1 inclusive servers which…

Priority P4 28 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C N I N A L

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. In versions between 1.2.0 and 1.6.1 inclusive servers which allow non-NTS traffic are affected by a denial of service vulnerability, where an attacker can induce a message storm between two NTP servers running ntpd-rs. Client-only configurations are not affected. Affected users are recommended to upgrade to version 1.6.2 as soon as possible.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	rust-ntpd	< rust-ntpd 1.6.2-1 (forky)	rust-ntpd 1.6.2-1 (forky)
pendulum-project	ntpd-rs	—	—
pendulum-project	ntpd-rs	>= 1.2.0 < 1.6.2	1.6.2

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

osv 5.3 MEDIUM

vendor_debian 5.3 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-406