CVE-2026-58058: Nmap IPv6 Extension Header DoS Vulnerability

CVE-2026-58058 Overview

CVE-2026-58058 is an integer underflow vulnerability [CWE-191] in Nmap through version 7.99. The flaw resides in ipv6_get_data_primitive within libnetutil/netutil.cc. Nmap fails to keep the IPv6 extension-header walk within the captured packet, allowing the parsing pointer to advance past the buffer. The remaining-length computation then underflows to a large value, producing out-of-bounds reads and a process crash during raw IPv6 scans.

An on-path attacker or a scanned target can trigger the issue by returning a crafted IPv6 response with a truncated extension header. The condition affects raw IPv6 scanning workflows used by penetration testers and network administrators.

Critical Impact
A crafted IPv6 response containing a truncated extension header crashes Nmap and can leak adjacent memory contents through out-of-bounds reads during active scans.

Affected Products

Nmap versions through 7.99
libnetutil component (netutil.cc)
Raw IPv6 scanning functionality

Discovery Timeline

2026-06-28 - CVE-2026-58058 published to NVD
2026-06-30 - Last updated in NVD database
Patch credited to Himanshu Anand via commit bb6754e

Technical Details for CVE-2026-58058

Vulnerability Analysis

The vulnerability originates in ipv6_get_data_primitive, which parses IPv6 headers and walks the chain of extension headers before returning a pointer to upper-layer data. The function advances a pointer p through each extension header using the length byte encoded in the header itself. The pre-patch check if (p + 2 > end) only validated that two bytes were readable, while the walk itself consumed eight bytes plus the declared extension length.

When an attacker supplies a truncated extension header, p advances past end. The subsequent statement *len = end - p then underflows because both pointers are treated in unsigned arithmetic. The caller receives a very large length value and a pointer past the buffer, which drives out-of-bounds reads in downstream protocol parsers and terminates the Nmap process.

Root Cause

The root cause is insufficient bounds validation on the IPv6 extension-header walk. The code trusted attacker-controlled length fields without ensuring the full 8-byte header fit inside the captured packet, and it did not re-check p < end after the loop exit.

Attack Vector

Exploitation requires the target to run an IPv6 Nmap scan against an attacker-controlled or on-path host. The attacker crafts an IPv6 reply where an extension-header Hdr Ext Len field advances the parser past the end of the captured packet. No authentication or user interaction beyond running the scan is required.

text

   *nxt = ip6->ip6_nxt;
   p += sizeof(*ip6);
   while (p < end && ipv6_is_extension_header(*nxt)) {
-    if (p + 2 > end)
+    if (p + 8 > end)
       return NULL;
     *nxt = *p;
     p += (*(p + 1) + 1) * 8;
   }
+  if (p >= end)
+    return NULL;
 
   *len = end - p;
   if (upperlayer_only && !ipv6_is_upperlayer(*nxt))

Source: Nmap commit bb6754e. The patch widens the length check to eight bytes and adds a post-loop p >= end guard that prevents the underflow of end - p.

Detection Methods for CVE-2026-58058

Indicators of Compromise

Unexpected crashes or segmentation faults of the nmap process during IPv6 scans (-6 flag)
IPv6 responses from scanned hosts containing extension headers with Hdr Ext Len values that push parsing beyond the captured packet length
Core dumps from nmap on scanning workstations correlated with active IPv6 reconnaissance

Detection Strategies

Monitor packet captures on scanning hosts for IPv6 replies whose Hop-by-Hop, Routing, or Destination Options headers declare a length exceeding the remaining packet
Alert on repeated Nmap process terminations tied to raw socket scans against untrusted network segments
Inspect IDS or NDR telemetry for malformed IPv6 extension-header chains directed at hosts known to run vulnerability scanning tooling

Monitoring Recommendations

Log the Nmap binary version deployed on scanning appliances and jump hosts to identify systems running 7.99 or earlier
Correlate crash telemetry from scanning workstations with outbound IPv6 scan activity to catch active exploitation attempts
Track file integrity of libnetutil and the nmap binary to confirm patch deployment across the fleet

How to Mitigate CVE-2026-58058

Immediate Actions Required

Upgrade Nmap to a release that includes commit bb6754e76bb1686315008e1aa1c40202a513fb83 from the Nmap repository
Inventory all workstations, containers, and CI runners shipping Nmap versions through 7.99 and prioritize patching for hosts that scan untrusted networks
Review the VulnCheck advisory and Nmap changelog for the fixed release

Patch Information

The fix is available in the upstream Nmap repository via commit bb6754e. The patch tightens the extension-header bounds check from two bytes to eight bytes and returns NULL when the pointer reaches or exceeds the packet end, eliminating the underflow of end - p. Rebuild libnetutil and the nmap binary from a source tree containing this commit, or install a distribution package that incorporates the fix.

Workarounds

Avoid raw IPv6 scans (nmap -6) against untrusted or attacker-controlled targets until patched
Restrict scanning workstations so that IPv6 responses from external hosts cannot reach the raw socket parser used by Nmap
Run Nmap inside an isolated container or virtual machine so a crash cannot affect production tooling

bash

# Verify installed Nmap version and rebuild from patched source
nmap --version
git clone https://github.com/nmap/nmap.git
cd nmap
git log --oneline | grep bb6754e
./configure && make && sudo make install