CVE-2026-72712: 
Nmap vulnerability analysis and mitigation

CVE-2026-72712 is a denial-of-service vulnerability in Nmap affecting all versions up to and including 7.99. It allows a remote attacker to crash the Nmap application by sending a crafted TCP packet containing a zero-length TCP option, which triggers an infinite loop and out-of-memory condition in the Packet:parse_options() function within nselib/packet.lua. The vulnerability was reported by Maxim Suhanov on May 21, 2026, and publicly disclosed on August 11, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). In nselib/packet.lua at line 697, the Packet:parse_options() function reads the length field (l) of each TCP option using self:u8(offset + opt_ptr + 1). When a malformed packet contains a TCP option with a length of zero, the loop variable opt_ptr is never incremented (opt_ptr = opt_ptr + l), causing the function to allocate new Lua table objects (options[op] = {}) indefinitely until the system's out-of-memory (OOM) killer terminates the process. Exploitation requires that Nmap be actively scanning a host that returns (or an attacker can inject) a response packet with a zero-length TCP option — meaning user interaction in the form of an active Nmap scan is a precondition. A proof-of-concept NSE script and hex payload were published in the original GitHub issue (GitHub Issue #3368, GitHub Commit).

Successful exploitation causes the Nmap process to consume all available system memory and crash, resulting in a complete loss of availability for the scanning operation. There is no impact on confidentiality or integrity — the vulnerability is limited to a denial-of-service condition affecting the Nmap application itself. The scope is unchanged, meaning the crash is confined to the Nmap process and does not directly affect other system services or enable lateral movement (GitHub Advisory, VulnCheck).

CISA's SSVC assessment classifies exploitation as "poc" (proof-of-concept available), with the vulnerability noted as not automatable and having partial technical impact (GitHub Issue #3368). The original bug report includes a working NSE script and a specific hex-encoded packet payload that reproduces the crash, constituting a functional PoC. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.42%, indicating a low near-term exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify a target running Nmap: Determine that the target environment uses Nmap ≤ 7.99 with NSE scripts that invoke packet.Packet:new() to parse responses (e.g., scripts targeting HTTPS services on port 443).
2. Craft a malicious TCP response packet: Construct a TCP packet with a zero-length TCP option in the options field. The PoC hex payload from the GitHub issue is: 45000044cc154000ee068872aaaaaaaabbbbbbbb01bbfbb9a06db07a41414142c012ffffb6fd0000020405b40402010103030101080a26e09a1c28541468000003001122 — note the trailing 000003001122 which includes a zero-length option (00 00).
3. Position the packet for delivery: Either control a host being scanned by Nmap (e.g., operate a malicious server) or perform a man-in-the-middle attack to inject the crafted response into the TCP stream between Nmap and its scan target.
4. Trigger the scan: Wait for or induce the Nmap operator to run a scan with an NSE script that parses TCP options against the attacker-controlled or MITM'd host (e.g., nmap -v --script=<script> -p443 <target>).
5. Achieve DoS: When Packet:parse_options() processes the zero-length option, it enters an infinite loop allocating Lua table objects, exhausting system memory and crashing the Nmap process (GitHub Issue #3368).

• Process: Nmap process exhibiting rapidly escalating memory consumption (gigabytes) before being killed by the OS OOM killer; unexpected Nmap process termination during active scans.
• Logs: System logs (e.g., /var/log/syslog, dmesg) showing OOM killer events referencing the nmap process; entries such as Out of memory: Kill process <PID> (nmap).
• Network: Inbound TCP response packets to the Nmap host containing malformed TCP options with a zero-length length field (byte value 0x00 in the option length position of the TCP options field); these may originate from hosts being scanned or from an intermediary performing injection (GitHub Issue #3368).

The fix was committed to the Nmap repository (commit 7ef4ee0) and adds a break statement in nselib/packet.lua to stop parsing when a zero-length TCP option is encountered, preventing the infinite loop. Users should upgrade Nmap to any version newer than 7.99 that includes this patch. As a network-level workaround, administrators can implement firewall or IDS rules to drop or sanitize inbound TCP packets with malformed (zero-length) options before they reach the host running Nmap. Restricting Nmap scanning operations to trusted network segments also reduces exposure (GitHub Commit, VulnCheck).

The vulnerability was discovered and reported by security researcher Maxim Suhanov, who noted in the GitHub issue that some real-world hosts return malformed TCP options that can trigger this crash, making it a practical concern for Nmap users scanning the public internet (GitHub Issue #3368). The Nmap maintainer (bonsaiviking) promptly committed a fix. VulnCheck assigned the CVE and published an advisory, and CISA-ADP added the issue reference to the NVD record. Community reaction has been measured, consistent with the moderate severity and limited exploitation potential of the vulnerability.