CVE-2026-72712

A flaw was found in Nmap. A remote attacker can exploit this denial of service vulnerability by sending a specially crafted packet that includes a zero-length Transmission Control Protocol (TCP) option. This malformed packet forces the application to enter an infinite loop during packet processing, consuming excessive memory and ultimately causing the Nmap application to crash.

Moderate: This denial of service vulnerability in Nmap allows a remote attacker to crash the application by sending a specially crafted TCP packet. The impact is limited to the availability of the Nmap process itself, typically affecting active network scanning operations rather than persistent services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid running Nmap with Network Scripting Engine (NSE) scripts that perform raw packet dissection against untrusted or potentially malicious network targets. This vulnerability is triggered by specially crafted TCP packets when Nmap is actively scanning with such scripts. If Nmap is not required, consider uninstalling the nmap package to eliminate the risk.