george0papasotiriou/cve-2026-22007-ntp-monlist-amplification-over-ipv6Python PoC for CVE-2026-22007: NTP monlist amplification over IPv6, including a simulated vulnerable server and spoofed UDP reflection attack.
monlist Amplification over IPv6# ntp_amplify_sim.py - NTP server responding to monlist without authentication
import socket, struct
def ntp_monlist_response():
# Simplified NTP reply with many entries
return b'\x00' * 1200 # large response
server = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
server.bind(('::', 123))
while True:
data, addr = server.recvfrom(1024)
# Vulnerability: no authentication, monlist enabled
resp = ntp_monlist_response()
server.sendto(resp, addr)
monlist Amplification over IPv6An NTP server supports the monlist command over IPv6 without access control. An attacker can send a small spoofed request, and the server reflects a much larger response to the victim, enabling DDoS amplification.
monlist feature returns a list of recent clients, generating a response up to 100 times larger than the request, and it requires no authentication.Start the simulated NTP server:
python ntp_amplify_sim.py
From attacker, send a spoofed UDP packet; the server bombards the victim.