CVE-2026-72712 in Nmap
Summary
by MITRE • 08/11/2026
Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability affects Nmap versions 7.99 and earlier, representing a critical denial of service weakness that can be exploited remotely by malicious actors. The flaw resides in how the network scanning tool processes TCP packet options, specifically when encountering malformed packets with zero-length TCP options. When such packets are received, the Packet:parse_options() function in nselib/packet.lua becomes trapped in an infinite allocation loop, continuously consuming system resources until the application crashes due to memory exhaustion. This represents a classic resource exhaustion attack pattern that undermines the availability of the scanning service.
The technical implementation of this vulnerability stems from insufficient input validation within the packet parsing logic. When Nmap encounters a TCP option with zero length, the parsing function fails to properly handle this edge case and instead enters an infinite loop where it continuously allocates memory objects without proper bounds checking or termination conditions. This behavior directly violates security principles related to robust input handling and resource management. The vulnerability maps to CWE-400, which covers "Uncontrolled Resource Consumption" and specifically addresses scenarios where applications fail to properly manage resource allocation under malformed input conditions.
From an operational perspective, this vulnerability poses significant risks to network administrators and security professionals who rely on Nmap for their scanning activities. An attacker could remotely trigger the application crash by sending a single malicious packet, effectively rendering the scanning tool unusable without requiring any authentication or elevated privileges. This makes the vulnerability particularly dangerous in environments where Nmap is used for continuous monitoring or automated scanning operations. The impact extends beyond simple application disruption to potentially interrupting critical network security workflows and penetration testing activities.
The attack surface for this vulnerability is broad, as it affects any system running vulnerable Nmap versions that process incoming TCP traffic. Network security tools and services that depend on Nmap's packet parsing capabilities are particularly at risk, including automated vulnerability scanners, IDS/IPS systems, and network monitoring solutions. The vulnerability can be exploited through various attack vectors where TCP packets are processed, including when scanning remote targets or processing captured network traffic. Organizations should consider implementing network segmentation and access controls to limit exposure while patches are deployed.
Mitigation strategies should focus on immediate patching of affected Nmap versions to the latest releases that contain fixes for this resource exhaustion issue. Network administrators should also implement network-level protections such as packet filtering rules that can identify and block malformed TCP packets with zero-length options before they reach vulnerable Nmap instances. Additionally, monitoring systems should be configured to detect unusual memory consumption patterns or application crashes that could indicate exploitation attempts. The remediation process should include comprehensive testing of patched versions in controlled environments to ensure no regression issues are introduced while maintaining the tool's scanning capabilities and functionality across different network environments.