PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7426 Ntp CVE debrief

CVE-2016-7426 is a denial-of-service issue in NTP versions before 4.2.8p9. When rate limiting for all associations is enabled, an attacker can send responses with a spoofed source address in a way that causes NTP to rate limit replies from configured sources, potentially preventing those sources from responding. The practical impact is loss of time synchronization service, which can disrupt systems that depend on accurate NTP responses.

Vendor
Ntp
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-13
Original CVE updated
2026-05-13
Advisory published
2017-01-13
Advisory updated
2026-05-13

Who should care

NTP administrators and operators, especially those running vulnerable NTP releases with rate limiting enabled for all associations. Organizations that depend on those systems for time synchronization should also care, since failed NTP responses can affect authentication, logging, scheduling, and other time-sensitive services.

Technical summary

According to the NVD description, NTP before 4.2.8p9 can incorrectly rate limit responses received from configured sources when rate limiting for all associations is enabled. A remote attacker can abuse spoofed source addresses to trigger that behavior and prevent responses from the sources. NVD assigns CWE-400 and a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting a network-reachable availability impact without evidence of confidentiality or integrity compromise.

Defensive priority

High. This is a remotely reachable availability issue in time synchronization infrastructure, which can have broad operational impact even without code execution.

Recommended defensive actions

  • Upgrade NTP to 4.2.8p9 or a vendor-supplied fixed release.
  • Apply vendor guidance from the NTP project and downstream advisories before re-enabling or changing rate-limiting settings.
  • Review whether 'rate limiting for all associations' is enabled in your environment and confirm that your configuration matches vendor recommendations.
  • Monitor NTP service health and time-synchronization status after remediation to ensure configured sources are responding normally.
  • If you rely on packaged or appliance-provided NTP, follow the applicable vendor advisory and update path rather than assuming the upstream version number alone is sufficient.

Evidence notes

The CVE description states that NTP before 4.2.8p9 is affected and that spoofed source addresses can cause denial of service by preventing responses from configured sources when rate limiting for all associations is enabled. NVD lists CWE-400 and documents multiple vendor and third-party advisories, including the NTP project bug/advisory pages and downstream advisories from Red Hat, FreeBSD, Ubuntu, and CERT.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7426 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7426

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7426 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7426

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.