CVE-2023-3036

7.5 highEPSS 2.2%

High (7.5) in cloudflare cfnts. EPSS 2.2% chance of exploitation in the next 30 days.

An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71 enabled a remote attacker to trigger a panic by sending an NTSAuthenticator packet with extension length longer than the packet contents.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWEs: CWE-125, CWE-119
Published: 2023-06-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cloudflare:cfnts

References

https://github.com/cloudflare/cfnts/security/advisories/GHSA-pwx6-gw47-96cp
https://github.com/cloudflare/cfnts/security/advisories/GHSA-pwx6-gw47-96cp

Check your stack JSON