CVE-2023-3036

HIGH 7.5CVE-2023-3036 · Published 14/06/2023 · updated 17/06/2026

In short

CVE-2023-3036 is a HIGH (CVSS 7.5) vulnerability affecting cfnts (cloudflare).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.8% of all vulnerabilities.
Fix: update to 2023-06-01 or later.

Package	Affected versions	Patched versions
cfnts cloudflare	`< 2023-06-01`	`2023-06-01`

Description

An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71 enabled a remote attacker to trigger a panic by sending an NTSAuthenticator packet with extension length longer than the packet contents.

References

cloudflare/cfnts security advisory · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free