Every CVE Search/ Get API key

CVE-2026-58058

Nmap - Integer Underflow in IPv6 Extension Header Parsing

6.9 MediumPublic exploitFix available

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

1.45%Up 1.2 points since Jun 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

Nmap - Integer Underflow in IPv6 Extension Header Parsing

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Record
CVE-2026-58058
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-191
Updated
2026-11-02
EUVDEUVD-2026-39978 6.9

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Record
EUVD-2026-39978
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wxvj-hc4r-fq45 6.9

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in...

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Record
GHSA-wxvj-hc4r-fq45
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-191
Updated
2026-11-02
NVD 6.9

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Record
CVE-2026-58058
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-191
Updated
2026-11-02
OSV 6.9

Nmap - Integer Underflow in IPv6 Extension Header Parsing

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Record
CVE-2026-58058
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-191
Updated
2026-11-02
OSVDEBIAN-CVE-2026-58058 6.9

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Record
DEBIAN-CVE-2026-58058
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 14 moreShow less
OSVOESA-2026-2955 6.5

nmap security update

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts.

Security Fix(es):

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.(CVE-2026-58058)

Record
OESA-2026-2955
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-2956 6.5

nmap security update

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts.

Security Fix(es):

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.(CVE-2026-58058)

Record
OESA-2026-2956
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-2957 6.5

nmap security update

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts.

Security Fix(es):

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.(CVE-2026-58058)

Record
OESA-2026-2957
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-2958 6.5

nmap security update

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts.

Security Fix(es):

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.(CVE-2026-58058)

Record
OESA-2026-2958
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-3094 6.5

nmap security update

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts.

Security Fix(es):

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.(CVE-2026-58058)

Record
OESA-2026-3094
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-58058 6.9

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Record
UBUNTU-CVE-2026-58058
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVAZL-91391 No score

CVE-2026-58058 affecting package nmap for versions less than 7.95-4

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Record
AZL-91391
Updated
2026-11-05
OSVCLSA-2026-1788628939 No score

nmap: Fix of CVE-2026-58058

  • CVE-2026-58058: keep the IPv6 extension-header walk inside the captured packet, preventing the remaining-length computation from underflowing and causing out-of-bounds reads during raw IPv6 scans
Record
CLSA-2026-1788628939
Updated
2026-11-02
OSVCLSA-2026-1788629925 No score

nmap: Fix of CVE-2026-58058

  • CVE-2026-58058: fix integer underflow in IPv6 extension header parsing leading to out-of-bounds read
Record
CLSA-2026-1788629925
Updated
2026-11-02
OSVMGASA-2026-0268 No score

Updated nmap packages fix a security vulnerability

The updated packages fix a security vulnerability: Integer Underflow in IPv6 Extension Header Parsing. (CVE-2026-58058)

Record
MGASA-2026-0268
Updated
2026-11-02
OSVSUSE-SU-2026:22739-1 No score

Security update for nmap

This update for nmap fixes the following issue

  • CVE-2026-58058: crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash (bsc#1269570).
Record
SUSE-SU-2026:22739-1
Updated
2026-11-02
OSVSUSE-SU-2026:22814-1 No score

Security update for nmap

This update for nmap fixes the following issue

  • CVE-2026-58058: crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash (bsc#1269570).
Record
SUSE-SU-2026:22814-1
Updated
2026-11-02
OSVSUSE-SU-2026:3333-1 No score

Security update for nmap

This update for nmap fixes the following issue

  • CVE-2026-58058: crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash (bsc#1269570).
Record
SUSE-SU-2026:3333-1
Updated
2026-11-02
OSVSUSE-SU-2026:3340-1 No score

Security update for nmap

This update for nmap fixes the following issue:

  • CVE-2026-58058: crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash (bsc#1269570).
Record
SUSE-SU-2026:3340-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nmap
Azure Linux:3
 before 7.95-4
7.95-4
nmap
TuxCare:AlmaLinux:9.6
 before 3:7.92-3.el9_6.tuxcare.els1
3:7.92-3.el9_6.tuxcare.els1
nmap-ncat
TuxCare:AlmaLinux:9.6
 before 3:7.92-3.el9_6.tuxcare.els1
3:7.92-3.el9_6.tuxcare.els1
nmap
TuxCare:AlmaLinux:9.2
 before 3:7.91-12.el9.tuxcare.els1
3:7.91-12.el9.tuxcare.els1
nmap-ncat
TuxCare:AlmaLinux:9.2
 before 3:7.91-12.el9.tuxcare.els1
3:7.91-12.el9.tuxcare.els1
nmap
Debian:12
 All versions, plus listed versions
7.93+dfsg1-17.94+dfsg1-17.94+dfsg1-1~exp17.94+dfsg1-27.94+dfsg1-3
Show 16 moreShow less
7.94+dfsg1-3~bpo12+17.94+dfsg1-47.94+git20230807.3be01efb1+dfsg-17.94+git20230807.3be01efb1+dfsg-1~bpo12+17.94+git20230807.3be01efb1+dfsg-27.94+git20230807.3be01efb1+dfsg-37.94+git20230807.3be01efb1+dfsg-47.94+git20230807.3be01efb1+dfsg-4~bpo12+17.95+dfsg-17.95+dfsg-27.95+dfsg-37.98+dfsg-17.98+dfsg-1~bpo13+17.99+dfsg-17.99+dfsg-27.991+dfsg-1
 None known
nmap
Debian:13
 All versions, plus listed versions
7.95+dfsg-37.98+dfsg-17.98+dfsg-1~bpo13+17.99+dfsg-17.99+dfsg-27.991+dfsg-1
 None known
nmap
Debian:14
 before 7.99+dfsg-2, plus listed versions
7.95+dfsg-37.98+dfsg-17.98+dfsg-1~bpo13+17.99+dfsg-1
7.99+dfsg-2
nmap
Mageia:10
 before 7.98-1.1.mga10
7.98-1.1.mga10
nmap
Mageia:9
 before 7.95-1.1.mga9
7.95-1.1.mga9
Show 20 moreShow less
Affected packages
PackageAffectedFixed
nmap
openEuler:20.03-LTS-SP4
 before 7.80-6.oe2003sp4
7.80-6.oe2003sp4
nmap
openEuler:22.03-LTS-SP4
 before 7.92-10.oe2203sp4
7.92-10.oe2203sp4
nmap
openEuler:24.03-LTS-SP1
 before 7.94-10.oe2403sp1
7.94-10.oe2403sp1
nmap
openEuler:24.03-LTS-SP3
 before 7.94-10.oe2403sp3
7.94-10.oe2403sp3
nmap
openEuler:24.03-LTS-SP4
 before 7.94-10.oe2403sp4
7.94-10.oe2403sp4
nmap
SUSE:Linux Micro Extras 6.2
 before 7.92-160000.3.1
7.92-160000.3.1
nmap
SUSE:Linux Enterprise Server 16.0
 before 7.92-160000.3.1
7.92-160000.3.1
nmap
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 7.92-160000.3.1
7.92-160000.3.1
nmap
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 6.46-3.9.1
6.46-3.9.1
nmap
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 7.92-150600.9.3.1
7.92-150600.9.3.1
nmap
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 7.92-150600.9.3.1
7.92-150600.9.3.1
nmap
Ubuntu:14.04:LTS
 All versions, plus listed versions
6.40-0.1ubuntu16.40-0.2ubuntu1
 None known
nmap
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.47-77.01-2ubuntu17.01-2ubuntu2
 None known
nmap
Ubuntu:18.04:LTS
 All versions, plus listed versions
7.60-1ubuntu17.60-1ubuntu27.60-1ubuntu37.60-1ubuntu47.60-1ubuntu5
 None known
nmap
Ubuntu:20.04:LTS
 All versions, plus listed versions
7.80+dfsg1-1build17.80+dfsg1-1build27.80+dfsg1-27.80+dfsg1-2build17.80+dfsg1-2ubuntu0.1
 None known
nmap
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.91+dfsg1+really7.80+dfsg1-27.91+dfsg1+really7.80+dfsg1-2build17.91+dfsg1+really7.80+dfsg1-2ubuntu0.1
 None known
nmap
Ubuntu:24.04:LTS
 All versions, plus listed versions
7.94+git20230807.3be01efb1+dfsg-17.94+git20230807.3be01efb1+dfsg-27.94+git20230807.3be01efb1+dfsg-37.94+git20230807.3be01efb1+dfsg-3build17.94+git20230807.3be01efb1+dfsg-3build2
 None known
nmap
Ubuntu:25.10
 All versions, plus listed versions
7.95+dfsg-27.95+dfsg-3
 None known
nmap
Ubuntu:26.10
 All versions, plus listed versions
7.98+dfsg-17.99+dfsg-1ubuntu17.99+dfsg-1ubuntu2
 None known
nmap
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.95+dfsg-37.98+dfsg-1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBNmap 7.99 - Extension Header Integer Underflow2026-08-17

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-58058 is a medium vulnerability (CVSS 6.9) in Nmap, published June 28, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in nmap 7.95-4.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open