CVE-2024-38528

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are unaffected. This vulnerability has been patched in version 1.1.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Jun 28, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-385298.8Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a CVE-2024-38537.5A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection started. This vulnerab CVE-2024-385309.8The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in CVE-2024-385313.6Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has acces CVE-2024-385327.1The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine fo CVE-2024-385336.5ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. There is possible invalid stack access due to the addresse CVE-2024-385347.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Crafted modbus traffic CVE-2024-385357.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Suricata can run out o CVE-2024-385367.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A memory allocation fa CVE-2024-385379.8Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features CVE-2024-385387.1In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have at least eth header len bytes syz CVE-2024-385395.5In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma