{"id":"CVE-2026-72712","title":"Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option","summary":"Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Pack…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-835"],"published":"2026-08-11","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:30:25.373","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72712","references":[{"url":"https://github.com/nmap/nmap","label":"disclosure@vulncheck.com"},{"url":"https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a","label":"disclosure@vulncheck.com"},{"url":"https://github.com/nmap/nmap/issues/3368","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/nmap-denial-of-service-via-zero-length-tcp-option-packet","label":"disclosure@vulncheck.com"},{"url":"https://github.com/nmap/nmap/issues/3368","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00608,"epssPercentile":0.46755,"ingestedAt":"2026-09-24T20:51:40.192Z","slug":"CVE-2026-72712","body":"## Overview\n\nNmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}