nmap-7.991

[Bruce Dubbs]

New minor version.

[Joe Locash]

Nmap 7.991 [2026-07-31]

o Fixed a memory-consumption hang in Ncat's HTTP proxy code that affected both
  connect and listen modes, reported by kumama_nui.

o Patched our included libssh2 source with upstream fixes for CVE-2025-15661,
  CVE-2026-7598, CVE-2026-55199, CVE-2026-55200, CVE-2026-58050, and
  CVE-2026-58051. The version number has been annotated as 1.11.1_NMAP1

o [Zenmap][GH#3347] Fixed several issues leading to crashes when parsing,
  editing, or saving command profiles containing '%' characters.

o [NSE][GH#2272] smb-enum-shares failed to produce output for valid shares when
  an error was encountered on one share.

o [GH#3410] Fixed an issue where DNS resolution would incorrectly fail to match
  the same name in a different case.

o [NSE][GH#1066] Added service names for SSL-protected services like
  amt-soap-https to portrules for several scripts, ensuring they run on these
  as well as the standard unencrypted services.

o Audited and converted most instances of strcat, strcpy, and sprintf to use
  bounded functions instead.

o [NSE][GH#2221] mysql-dump-hashes now uses the correct column name for MySQL 5.
7+

o [NSE][GH#2238] http-referer-checker was incorrectly fetching off-host URLs.
  Now only URLs on the target are fetched.

o [GH#2122] When an interface is specified with -e, also bind to the IP address
  for that device so that it works for non-Linux systems and non-root users.

o [Nsock][GH#1939] When nsock_iod_set_localaddr() is used, nsock_connect_*()
  will now treat errors in bind(2) as connection failure.

o [GH#2732] Fix a potential crash on 32-bit platforms in debug mode due to
  incorrect format specifier for 64-bit integer type. [Christopher Chavez]

o [GH#3201][GH#3367] Increase line length limit for nmap-service-probes and
  correctly handle lines that are too long. [@liquidpele, Ashutosh Kumar Singh]

o [GH#3414] Avoid out-of-bounds read when parsing PTR domain names. [@toor11 (Ju
ri)]

o [GH#2245] Ensure variables updated by signal handlers are volatile sig_atomic_
t.

o [Ncat][GH#1410] Fix an assertion failure (count <= INT_MAX) in ncat -lk in
  some cases where stdin or a listening socket produces an error.

o [NSE][GH#1946] Fix a cryptic error in smb-enum-services, "Server returned
  less data than needed for header" when smb.start_smb() failed.

o Fixed an issue with parsing nmap-service-probes that could cause a corrupted
  file to crash Nmap. Reported by Muhammed Hussein.

o [NSE][GH#2016] Removed hostmap-bfk.nse, since the service it used shut down.

o Fixed several issues reported by Himanshu Anand: infinite loop in TCP options
  parsing and out-of-bounds memory read in IPv4 OS detection; integer underflow
  in IPv6 extension header processing; and undefined behavior in DNS label parsing.

o [GH#2721] Added checks for returned pointers from OpenSSL allocation functions.

o [GH#1546] Fix an incorrect assertion "timeout / 1000 <= (long) o.scan_delay"
  in traceroute which failed for timeouts greater than 1 second when there was
  no scan delay.

o [GH#3175] The --stats-every option can now be used in conjunction with
  --noninteractive. Previously, no stats messages were printed if a TTY was not
  attached.

o [GH#3375] Nmap can now be built with OpenSSL 4.0

o [Nping][GH#1751] The --rate option will not accept a rate higher than 1000
  packets per second, since Nsock timers have millisecond resolution. Use
  --delay 0 for unlimited rate.

o [Nping] Fixed several issues with Nping in IPv6 mode including:

  + [GH#1261] Incorrect BPF generated leading to "expression rejects all packets"

  + [GH#3215] Incorrect constant used to check for IP version in Echo Server

o [NSE][GH#3368] Fixed an out-of-memory issue in packet.lua when parsing a
  zero-length TCP header option. [Maxim Suhanov]

o Fixed an issue where Nmap OS scan trusts a packet's ip_len to size a CRC32
  computation over TCP RST payload data, which may result in reading arbitrary
  heap data. Reported by Michael Bommarito.

o [Ncat][GH#3005] Correctly report listening port number. `ncat -l -p 0` will
  cause Ncat to listen on an ephemeral port, but it was reporting itself as
  listening on port 0.

o [Ncat][GH#1672] Fixed an issue where Ncat in server mode would quit without
  printing the last received data on a connection, particularly affecting SCTP.

o [Ncat][GH#2827] Fixed an issue where Ncat in --send-only mode would ignore
  disconnects and crash when it tries to send data to a disconnected client.

o [Ncat][GH#3291] Fixed an issue where Ncat on Windows would quit after 2
  minutes due to an OS-enforced timeout on the half-open TCP socket used to
  emulate STDIN.

o [Nping][GH#564] Allow Nping to fall back to TCP Connect mode on Windows when
  Npcap is not installed.

o [Ncat] Fixed several issues reported by Muhammed Hussein involving crashes in
  Ncat's server-mode HTTP proxy, as well as one code-quality issue with its
  Telnet negotiation code.

o [Nsock][GH#2595] Fix an issue where Nsock's SOCKS4 proxy code would send
  additional null bytes on Windows and other platforms where the compiler does
  not understand __attribute__((packed)). [Daniel Miller]

o The --release-memory option is now a no-op. Nmap will always run finalization
  routines that release allocated memory before closing.

o Fixed an integer underflow in service_scan.cc that would cause little-endian
  integers extracted from the beginning of a service banner to be interpreted
  as 0. Discovered with AFL++ by Malek Althubiany.

o [Nsock][GH#583] Use OpenSSL security levels and callbacks to prevent errors
  connecting to certain insecure targets when using NSOCK_SSL_MAX_SPEED. The
  default, as used in Ncat, now uses stricter-than-default security level.

o [GH#410] If a target times out due to --host-timeout, do not perform traceroute.

o [Nping][GH#380] Disallow combining Ethernet-related options like --dest-mac
  with --send-ip

o [NSE][GH#3250][GH#3206] Fix assertion failures in cases where connect or send
  returns immediately with a status other than ERROR, e.g. TIMEOUT or CANCELED.
  [Daniel Miller]

o [Ncat][GH#290] Enable ncat -l --ssl to use DHE and ECDHE cipher suites for
  perfect forward secrecy.

o Fix a crash when writing long CPE strings to output. Reported by Harshit
  Gupta. [Daniel Miller]

o [Ncat] Fix several cases where Ncat's SOCKS5 client could interpret
  uninitialized data as protocol data, triggered by a malicious SOCKS5 proxy
  server. No code execution or application crash is possible.
  Reported by Govind Pratap Singh. [Daniel Miller]

o [Nping] Fix a out-of-bounds access in Nping Echo client allowing a malicious Nping
  EchoServer to zero 32 bytes of memory outside the packet buffer. Reported by
  Harshit Gupta. [Daniel Miller]

o Fix a 1-byte overrun (read) while reading certain crafted DNS labels,
  reported by Peter Parker. [Daniel Miller]

o [NSE][GH#3317] Function url.build_path was mangling special characters in URL
  path segments. [nnposter]

Fixed at 3beeccf30c.