Skip to main content

Nmap CVE-2026-72712

| EUVDEUVD-2026-56821 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-08-11 disclosure@vulncheck.com GHSA-7j7x-fg87-hwwg
Denial Of Service Red Hat Suse
6.9
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-delivered crash requires operator to initiate scan toward attacker (UI:R); attacker needs no privileges; impact is availability-only with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 11, 2026 - 22:48 vuln.today
Analysis Generated
Aug 11, 2026 - 22:48 vuln.today
CVE Published
Aug 11, 2026 - 18:18 cve.org
MEDIUM 6.9

DescriptionCVE.org

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

AnalysisAI

Denial of service in Nmap versions through 7.99 allows a remote party to crash the application by returning a crafted TCP packet containing a zero-length option to a host actively scanning their infrastructure. The vulnerable code path is in the NSE library packet.lua, where the Packet:parse_options() function allocates objects indefinitely when it encounters a zero-length TCP option, exhausting memory and terminating the process. No active exploitation has been confirmed and no formal patched release version has been identified, though an upstream source-level fix is available via GitHub commit.

Technical ContextAI

Nmap's Scripting Engine (NSE) uses nselib/packet.lua to parse raw network packets captured during scans. The Packet:parse_options() function iterates over TCP header option fields, reading each option's type and length. CWE-835 (Loop with Unreachable Exit Condition) is the precise root cause: when a TCP option with a length value of zero is encountered, the original code advanced the loop's byte offset by zero, meaning the loop cursor never moved forward. Each iteration reallocated a new options[op] table entry without progressing, creating an unbounded allocation loop. The upstream fix (commit 7ef4ee030a0023fe22616387a000032e1a678b6a) inserts an explicit break statement when l==0 is detected, before any allocation occurs, terminating the loop safely. This is a pure Lua-layer bug within NSE and does not affect Nmap's core C/C++ engine directly.

RemediationAI

The upstream fix is available as commit 7ef4ee030a0023fe22616387a000032e1a678b6a on the Nmap GitHub repository (https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a); however, a formally tagged and released patched version number has not been confirmed from the available intelligence data, so users should monitor official Nmap release channels and distribution package repositories for a versioned release incorporating this commit. Users who can build from source may apply the patch directly by updating nselib/packet.lua from the patched commit. As a compensating control where immediate patching is not feasible, restrict Nmap usage to scanning only trusted, controlled networks where injected or attacker-crafted TCP responses cannot reach the scanning host - this eliminates the attack surface without disabling Nmap entirely. Alternatively, avoid running NSE scripts that exercise TCP option parsing against untrusted hosts until a patched release is available. Note that restricting scanning scope may reduce coverage in external attack-surface management workflows.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

CVE-2026-72712 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy