CVE-2009-3563: Ntp

Medium severity, CVSS 6.4. EPSS: 32.1% chance of exploitation in the next 30 days.

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.

Affected products

• Ntp Ntp: up to and including 4.2.2p4; version 4.0.72 only; version 4.0.73 only; version 4.0.90 only; version 4.0.91 only; version 4.0.92 only; …

Published 2009-12-09. Last modified 2026-06-16.