CVE-2026-72712: Nmap Denial of Service Vulnerability

CVE-2026-72712 Overview

CVE-2026-72712 is a denial of service vulnerability affecting Nmap versions up to and including 7.99. The flaw resides in the Packet:parse_options() function within nselib/packet.lua. A remote attacker can send a crafted packet containing a zero-length TCP option, forcing the parser into an infinite object allocation loop. The result is an out-of-memory condition that crashes the Nmap process. The issue is tracked as CWE-835: Loop with Unreachable Exit Condition and requires user interaction, since a scan operator must actively probe the malicious host.

Critical Impact
Remote attackers can crash Nmap-based scanning workflows by returning a malformed TCP option, disrupting network reconnaissance, monitoring scripts, and automated security tooling that depends on Nmap NSE.

Affected Products

Nmap versions up to and including 7.99
Nmap Scripting Engine (NSE) library nselib/packet.lua
Automated tooling and pipelines that invoke Nmap NSE against untrusted hosts

Discovery Timeline

2026-08-11 - CVE-2026-72712 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72712

Vulnerability Analysis

The vulnerability is a denial of service condition triggered during TCP option parsing inside the Nmap Scripting Engine. When Packet:parse_options() encounters a TCP option with a declared length of zero, the parser fails to advance its offset pointer. The while opt_ptr < length do loop therefore never terminates. On each iteration the code allocates a new option table entry, driving Lua memory usage upward until the process exhausts available memory and aborts. Because Nmap actively initiates the connection, an attacker only needs to control a target host or intermediate device that responds with the malformed packet.

Root Cause

The root cause is missing input validation on the TCP option length field. The parser reads the option type at the current offset, but for option types outside the special-case handling (types 0 and 1), it consumes a length byte without verifying the value is greater than zero before advancing opt_ptr. A zero-length option keeps opt_ptr static, producing an unbounded loop that allocates a fresh table on every pass.

Attack Vector

The attack vector is network-based and requires user interaction, since a security operator must initiate an Nmap scan against an attacker-controlled endpoint. The attacker crafts a TCP response containing an option with length = 0. When Nmap's NSE-based scripts parse the packet, the memory exhaustion loop terminates the scanner. The vulnerability does not permit code execution or information disclosure.

text

# Security patch in nselib/packet.lua (excerpt)
  local opt_ptr = 0
  while opt_ptr < length do
    local t, l, d
-    options[op] = {}
-
    t = self:u8(offset + opt_ptr)
-    options[op].type = t
    if t==0 or t==1 then
      l = 1
      d = nil

Source: GitHub Nmap Commit 7ef4ee0. The patch removes the pre-loop allocation of options[op] and adjusts parsing so that zero-length options no longer trigger unbounded table creation.

Detection Methods for CVE-2026-72712

Indicators of Compromise

Nmap processes terminating unexpectedly with out-of-memory errors during active scans
Scan jobs consistently failing when probing a specific host or network segment
Sudden RSS memory growth in the Nmap process immediately before termination
TCP response packets containing malformed option headers with a zero-length field

Detection Strategies

Inspect scanner logs for abnormal termination signals or lua: not enough memory errors originating from NSE scripts
Capture and inspect PCAP traffic from failed scans, searching for TCP options with Length = 0 in the options field
Compare Nmap version output (nmap --version) against the fixed upstream release to identify vulnerable installations

Monitoring Recommendations

Monitor host and container memory metrics for scanning infrastructure, alerting on rapid consumption by nmap processes
Log every scan target and correlate failed jobs with responding hosts to identify attacker-controlled endpoints
Track exit codes and stderr output from automated Nmap wrappers used in CI/CD or continuous attack surface tooling

How to Mitigate CVE-2026-72712

Immediate Actions Required

Upgrade Nmap to a version that includes commit 7ef4ee0 or later, which fixes Packet:parse_options()
Restrict scanning of untrusted or attacker-controlled network ranges until patched
Isolate Nmap scanning hosts so that a crash does not impact adjacent security tooling

Patch Information

The upstream fix is available in the Nmap GitHub repository via commit 7ef4ee030a0023fe22616387a000032e1a678b6a. The patch modifies nselib/packet.lua so that parsing stops on a zero-length packet option, preventing the infinite allocation loop. Additional context is available in Nmap Issue #3368 and the VulnCheck Nmap DoS Advisory.

Workarounds

Avoid running NSE scripts that invoke Packet:parse_options() against untrusted targets until the patch is applied
Apply the upstream nselib/packet.lua change directly to installations that cannot be upgraded immediately
Run scanning tools under memory limits (for example, systemdMemoryMax or container --memory flags) so a crash is contained

bash

# Verify the installed Nmap version and locate the patched Lua module
nmap --version
grep -n "parse_options" $(nmap --datadir 2>/dev/null || echo /usr/share/nmap)/nselib/packet.lua

# Example: constrain Nmap memory usage on Linux to contain a crash
systemd-run --scope -p MemoryMax=1G nmap -sS -sV <target>