CVE-2016-6301 Denial of service in n/a

High 7.5 Published 9 Dec 2016 Updated 4 Dec 2025

Remote attackers can cause denial of service in BusyBox NTP client via forged packets, leading to CPU and bandwidth exhaustion.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-6301?

CVE-2016-6301 is a high-severity denial of service vulnerability in n/a, published on 9 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.

Weakness: CWE-399, CWE-835

Which versions are affected by CVE-2016-6301?

It affects 1 product.

Products include Busybox Busybox.

How do I fix CVE-2016-6301?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2016-6301 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-6301 exists.

Sources

Also known as ALPINE-CVE-2016-6301, DEBIAN-CVE-2016-6301, GHSA-ww72-35h4-5v84, MGASA-2016-0277.