CVE-2023-3036: Cloudflare Cfnts

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71  enabled a remote attacker to trigger a panic by sending an NTSAuthenticator packet with extension length longer than the packet contents.

Affected products

• Cloudflare Cfnts: before 2023-06-01 (fixed in 2023-06-01)

Published 2023-06-14. Last modified 2026-06-17.