Every CVE Search/ Get API key

CVE-2026-72712

Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet

6.9 MediumFix available

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.50%Up 0.1 points since Aug 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Record
CVE-2026-72712
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
EUVDEUVD-2026-56821 6.9

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Record
EUVD-2026-56821
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-7j7x-fg87-hwwg 6.9

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows...

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Record
GHSA-7j7x-fg87-hwwg
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
NVD 6.9

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Record
CVE-2026-72712
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSV 6.9

Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Record
CVE-2026-72712
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-835
Updated
2026-11-05
OSVDEBIAN-CVE-2026-72712 6.9

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Record
DEBIAN-CVE-2026-72712
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 11 moreShow less
OSVOESA-2026-3679 6.5

nmap security update

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts.

Security Fix(es):

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.(CVE-2026-72712)

Record
OESA-2026-3679
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3680 6.5

nmap security update

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts.

Security Fix(es):

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.(CVE-2026-72712)

Record
OESA-2026-3680
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3681 6.5

nmap security update

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts.

Security Fix(es):

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.(CVE-2026-72712)

Record
OESA-2026-3681
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3682 6.5

nmap security update

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts.

Security Fix(es):

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.(CVE-2026-72712)

Record
OESA-2026-3682
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3745 6.5

nmap security update

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts.

Security Fix(es):

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.(CVE-2026-72712)

Record
OESA-2026-3745
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-72712 6.9

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Record
UBUNTU-CVE-2026-72712
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-95529 No score

CVE-2026-72712 affecting package nmap for versions less than 7.95-5

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Record
AZL-95529
Updated
2026-11-05
OSVCLSA-2026-1789630245 No score

nmap: Fix of CVE-2026-72712

  • CVE-2026-72712: stop parsing packet options on a zero-length option, preventing an infinite allocation loop and out-of-memory abort in the NSE packet library
Record
CLSA-2026-1789630245
Updated
2026-11-02
OSVCLSA-2026-1790157825 No score

nmap: Fix of CVE-2026-72712

  • CVE-2026-72712: stop parsing packet options on a zero-length option, preventing an infinite allocation loop and out-of-memory abort in the NSE packet library
Record
CLSA-2026-1790157825
Updated
2026-11-02
OSVMGASA-2026-0433 No score

Updated nmap packages fix a security vulnerability

Denial of Service via Zero-Length TCP Option Packet. (CVE-2026-72712)

Record
MGASA-2026-0433
Updated
2026-11-02
OSVSUSE-SU-2026:24515-1 No score

Security update for nmap

This update for nmap fixes the following issue:

  • CVE-2026-72712: crafted packet containing a zero-length TCP option causes the Packet:parse_options() function to allocate objects in an infinite loop and cause an OOM condition (bsc#1275288).
Record
SUSE-SU-2026:24515-1
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nmap
Azure Linux:3
 before 7.95-5
7.95-5
nmap
TuxCare:AlmaLinux:9.6
 before 3:7.92-3.el9_6.tuxcare.els2
3:7.92-3.el9_6.tuxcare.els2
nmap-ncat
TuxCare:AlmaLinux:9.6
 before 3:7.92-3.el9_6.tuxcare.els2
3:7.92-3.el9_6.tuxcare.els2
nmap
TuxCare:AlmaLinux:9.2
 before 3:7.91-12.el9.tuxcare.els2
3:7.91-12.el9.tuxcare.els2
nmap-ncat
TuxCare:AlmaLinux:9.2
 before 3:7.91-12.el9.tuxcare.els2
3:7.91-12.el9.tuxcare.els2
nmap
Debian:12
 All versions, plus listed versions
7.93+dfsg1-17.94+dfsg1-17.94+dfsg1-1~exp17.94+dfsg1-27.94+dfsg1-3
Show 16 moreShow less
7.94+dfsg1-3~bpo12+17.94+dfsg1-47.94+git20230807.3be01efb1+dfsg-17.94+git20230807.3be01efb1+dfsg-1~bpo12+17.94+git20230807.3be01efb1+dfsg-27.94+git20230807.3be01efb1+dfsg-37.94+git20230807.3be01efb1+dfsg-47.94+git20230807.3be01efb1+dfsg-4~bpo12+17.95+dfsg-17.95+dfsg-27.95+dfsg-37.98+dfsg-17.98+dfsg-1~bpo13+17.99+dfsg-17.99+dfsg-27.991+dfsg-1
 None known
nmap
Debian:13
 All versions, plus listed versions
7.95+dfsg-37.98+dfsg-17.98+dfsg-1~bpo13+17.99+dfsg-17.99+dfsg-27.991+dfsg-1
 None known
nmap
Debian:14
 All versions, plus listed versions
7.95+dfsg-37.98+dfsg-17.98+dfsg-1~bpo13+17.99+dfsg-17.99+dfsg-27.991+dfsg-1
 None known
nmap
Mageia:10
 before 7.98-1.2.mga10
7.98-1.2.mga10
nmap
Mageia:9
 before 7.95-1.2.mga9
7.95-1.2.mga9
Show 15 moreShow less
Affected packages
PackageAffectedFixed
nmap
openEuler:20.03-LTS-SP4
 before 7.80-7.oe2003sp4
7.80-7.oe2003sp4
nmap
openEuler:22.03-LTS-SP4
 before 7.92-11.oe2203sp4
7.92-11.oe2203sp4
nmap
openEuler:24.03-LTS-SP1
 before 7.94-11.oe2403sp1
7.94-11.oe2403sp1
nmap
openEuler:24.03-LTS-SP3
 before 7.94-11.oe2403sp3
7.94-11.oe2403sp3
nmap
openEuler:24.03-LTS-SP4
 before 7.94-11.oe2403sp4
7.94-11.oe2403sp4
libsoup
SUSE:Linux Micro 6.2
 before 3.6.6-160000.5.1
3.6.6-160000.5.1
nmap
SUSE:Linux Micro Extras 6.2
 before 7.92-160000.4.1
7.92-160000.4.1
nmap
Ubuntu:14.04:LTS
 All versions, plus listed versions
6.40-0.1ubuntu16.40-0.2ubuntu1
 None known
nmap
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.47-77.01-2ubuntu17.01-2ubuntu2
 None known
nmap
Ubuntu:18.04:LTS
 All versions, plus listed versions
7.60-1ubuntu17.60-1ubuntu27.60-1ubuntu37.60-1ubuntu47.60-1ubuntu5
 None known
nmap
Ubuntu:20.04:LTS
 All versions, plus listed versions
7.80+dfsg1-1build17.80+dfsg1-1build27.80+dfsg1-27.80+dfsg1-2build17.80+dfsg1-2ubuntu0.1
 None known
nmap
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.91+dfsg1+really7.80+dfsg1-27.91+dfsg1+really7.80+dfsg1-2build17.91+dfsg1+really7.80+dfsg1-2ubuntu0.1
 None known
nmap
Ubuntu:24.04:LTS
 All versions, plus listed versions
7.94+git20230807.3be01efb1+dfsg-17.94+git20230807.3be01efb1+dfsg-27.94+git20230807.3be01efb1+dfsg-37.94+git20230807.3be01efb1+dfsg-3build17.94+git20230807.3be01efb1+dfsg-3build2
 None known
nmap
Ubuntu:26.10
 All versions, plus listed versions
7.98+dfsg-17.99+dfsg-1ubuntu17.99+dfsg-1ubuntu2
 None known
nmap
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.95+dfsg-37.98+dfsg-1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-72712 is a medium vulnerability (CVSS 6.9) in Nmap Project Nmap, published August 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in nmap 7.95-5.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open