Description

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T18:18:23.550Z",
  "pubdate": "2026-08-11T18:18:23.550Z",
  "executiveSummary": "An application-layer denial of service vulnerability exists in Nmap versions up to and including 7.99, affecting the Lua-based packet parsing library. The vulnerability is triggered by remote attackers sending a specially crafted packet containing a zero-length TCP option to the targeted Nmap instance.\nThe primary impact of successful exploitation is an immediate application crash resulting from an out-of-memory condition. This compromises the availability of the scanning utility, terminating ongoing network discovery and analysis operations.\nThe affected product is Nmap, specifically its script engine packet manipulation library. The risk implications are moderate to high depending on operational dependencies, as attackers can disrupt security assessments, penetration tests, or automated network monitoring systems relying on Nmap.\nAttacker capabilities are strictly limited to causing a denial of service; remote code execution or unauthorized data access are not enabled by this vulnerability. Exploitation requirements involve the attacker's ability to transmit network traffic to an active Nmap scanning session or listening script that processes incoming packets, requiring no prior authentication or privileged access.",
  "technicalDetails": "The root cause of the vulnerability resides in improper input validation and loop handling within the Packet:parse_options() function located in the file nselib/packet.lua. Specifically, when processing incoming TCP options, the parsing logic fails to adequately handle anomalous input formats, specifically a zero-length TCP option.\nThe vulnerable component is the Nmap Scripting Engine (NSE) packet library, which is utilized for constructing, sending, and parsing network packets within Lua scripts. Affected versions include all Nmap iterations up to and including version 7.99.\nAuthentication and privilege requirements are absent, as the vector is network-based and relies on packet processing logic. The network exposure requires the target Nmap instance to be actively receiving and parsing raw network traffic or packets via NSE scripts.\nThe attack flow proceeds as follows: First, an attacker identifies or anticipates an active Nmap scan or a listening NSE script capable of ingesting raw packets. Second, the attacker transmits a malformed TCP packet containing a zero-length TCP option directly to the scanning source or listener. Third, upon receipt, the Nmap application invokes the Packet:parse_options() function in nselib/packet.lua to iterate through and decode the TCP options present in the packet header.\nDuring the execution of Packet:parse_options(), the presence of the zero-length TCP option causes the parsing algorithm to malfunction. Instead of advancing the pointer or terminating the parsing loop upon encountering the malformed option, the function enters an infinite loop. Within this infinite loop, the application continuously allocates objects in memory without releasing them.\nThis runaway allocation rapidly consumes available system resources, precipitating a critical out-of-memory condition. The host operating system or the Lua runtime environment is subsequently forced to terminate the Nmap process, achieving the denial of service objective.\nThe post-exploitation impact is strictly confined to application termination. Because the flaw induces a crash via memory exhaustion, no persistent access, privilege escalation, or arbitrary code execution capabilities are granted to the remote attacker."
}