{"id":"CVE-2026-102483","summary":"Reachable Assertion in ntpsec","details":"Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.","modified":"2026-10-22T02:48:44.816310574Z","published":"2026-10-21T15:03:41.276Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"1.1.4"},{"fixed":"1.2.6"}],"source":"AFFECTED_FIELD"}]}],"cna_assigner":"GitLab","cwe_ids":["CWE-617"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102483.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102483.json"},{"type":"PACKAGE","url":"https://gitlab.com/NTPsec/ntpsec"},{"type":"FIX","url":"https://gitlab.com/NTPsec/ntpsec/-/commit/df83f3c4f"},{"type":"WEB","url":"https://gitlab.com/NTPsec/ntpsec/-/work_items/899"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102483"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/NTPsec/ntpsec","events":[{"introduced":"79cd18fc56fc902c3a7fd78bcc32ee72f52eb396"},{"last_affected":"42b5703303c8c7e6513f3a119cfab670924dd7be"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.1.4"},{"last_affected":"1.2.5"}],"source":"DESCRIPTION"}]}}],"versions":["NTPsec_1_2_5","NTPsec_1_2_4","NTPsec_1_2_3","NTPsec_1_2_2","NTPsec_1_2_1","NTPsec_1_2_0","NTPsec_1_1_9","NTPsec_1_1_8","NTPsec_1_1_7","NTPsec_1_1_6","NTPsec_1_1_5","NTPsec_1_1_4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102483.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}