CVE-2026-58058

Name
CVE-2026-58058
Description
Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/bikini/exploitarium/tree/main/nmap-ipv6-extlen-wrap-poc
disclosure@vulncheck.com https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83
disclosure@vulncheck.com https://nmap.org/changelog.html
disclosure@vulncheck.com https://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension-header-parsing

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:nmap:nmap:*:*:*:*:*:*:*:* nmap >= None <= 7.99

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nmap edge-main 7.99-r0 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap edge-main 7.98-r0 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap edge-main 7.97-r0 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap edge-main 7.96-r0 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap edge-main 7.95-r1 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap edge-main 7.80-r0 None possibly vulnerable
nmap 3.24-main 7.99-r0 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap 3.23-main 7.97-r0 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap 3.22-main 7.97-r0 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap 3.22-main 7.80-r0 None possibly vulnerable
nmap 3.21-main 7.95-r1 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap 3.21-main 7.80-r0 None possibly vulnerable
nmap 3.20-main 7.95-r0 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap 3.20-main 7.80-r0 None possibly vulnerable
nmap 3.19-main 7.94-r0 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
nmap 3.19-main 7.80-r0 None possibly vulnerable