CVE-2026-72712

MEDIUM 6.5

Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

CWE	CWE-835
Vendor	nmap project
Product	nmap
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for nmap project nmap

Be the first to know when new medium vulnerabilities affecting nmap project nmap are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

Nmap Project / Nmap

0 ≤ 7.99

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nmap/nmap github.com: https://github.com/nmap/nmap/issues/3368 github.com: https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a vulncheck.com: https://www.vulncheck.com/advisories/nmap-denial-of-service-via-zero-length-tcp-option-packet

Credits

Maxim Suhanov