Executive brief
Nmap is a widely-used network scanning and security auditing tool. A vulnerability in versions up to 7.99 allows an attacker to crash the application by sending a specially crafted network packet with a malformed TCP option, resulting in service unavailability and potential disruption of security assessments or network monitoring operations.
Technical details
The vulnerability is a denial of service condition triggered by a zero-length TCP option in a crafted packet. The Packet:parse_options() function in nselib/packet.lua enters an infinite loop when processing the malformed option, causing unbounded memory allocation that exhausts available memory and crashes the application. The attack requires network connectivity to reach the Nmap instance and can be exploited by sending a single malicious packet. A patch is available in the Nmap repository (commit 7ef4ee0) that stops option parsing upon encountering a zero-length packet option.
Affected products
- Nmap Nmap up to and including 7.99
Timeline
- 2026-08-11: disclosed
- patched: Patch available in Nmap repository commit 7ef4ee0