Description
Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Nmap | Nmap | ≤ 7.99 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nmap | 7.99+dfsg-2 | — |
| Debian 13 | nmap | No fix yet | — |
| Debian 12 | nmap | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | nmap | No fix yet | — |
| Ubuntu 26.04 LTS | nmap | No fix yet | — |
| Ubuntu 25.10 | nmap | No fix yet | — |
| Ubuntu 24.04 LTS | nmap | No fix yet | — |
| Ubuntu 22.04 LTS | nmap | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | nmap | No fix yet | — |
| Ubuntu 18.04 LTS | nmap | No fix yet | — |
| Ubuntu 16.04 LTS | nmap | No fix yet | — |
| Ubuntu 14.04 LTS | nmap | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | nmap | 7.92-150600.9.3.1 | SUSE-SU-2026:3340-1 |
| SLES 12 SP5 | nmap | 6.46-3.9.1 | SUSE-SU-2026:3333-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | nmap | 7.92-160000.3.1 | SUSE-SU-2026:22814-1 |
| SLES 16.0 | nmap | 7.92-160000.3.1 | SUSE-SU-2026:22814-1 |
| SLE Micro 6.2 | nmap | 7.92-160000.3.1 | SUSE-SU-2026:22739-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nmap | 7.95-4 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | nmap | 7.991-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Nmap 7.99 - Extension Header Integer Underflow EDB-52647 · dos · Aug 17, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- WID-SEC-2026-2098 nmap: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 17, 2026
- SUSE-SU-2026:3333-1 Security update for nmap SUSE / openSUSE Security Updates · Jul 29, 2026
- SUSE-SU-2026:3340-1 Security update for nmap SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22814-1 Security update for nmap SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22739-1 Security update for nmap SUSE / openSUSE Security Updates · Jul 23, 2026
References
- Proof of Concept exploit third-party-advisory
- Fix commit (dev tree) patch
- Nmap Change Log release-notes
- VulnCheck Advisory: Nmap - Integer Underflow in IPv6 Extension Header Parsing third-party-advisory