nmap-7.992

[Bruce Dubbs]

New minor version.

[Joe Locash]

Nmap 7.992 [2026-10-07]

o Upgraded included libraries:
  - Source: libpcap 1.10.7, pcre2 10.49, lua 5.4.9, libdnet 1.18.2
  - Binary installers: OpenSSL 3.5.9, Python 3.14.8

o [Security][NSE] Karan Bamal of SentinelOne reported the following issues with
  NSE scripts and libraries, which have all been fixed:
  - afp.lua used a hardcoded DH private exponent, so that credentials passed
    via command line could be decrypted from network traffic. The DHCAST128 UAM
    is known to be cryptographically broken, and has been replaced in this
    release with DHX2.
  - Redirect to unverified URL in anyconnect.lua and upnp.lua
  - Unbounded memory consumption in rpc.lua, drda.lua, eigrp.lua,
    msrpctypes.lua, db2-das-info, and dns-zone-transfer
  - Uninterruptible CPU usage (infinite loop) not subject to --script-timeout or
    --host-timeout in rdp.lua, tn3270.lua, and ospf.lua
  - Infinite loop waiting for errored coroutines in tftp.lua, effectively
    mitigated by --script-timeout

o [Security] Zach Hanley of Horizon3.ai, in collaboration with Claude and
  Anthropic Research, reported three issues, which have all been fixed:
  - Two distinct use-after-free bugs in massdns parallel DNS resolver.
  - NSE uses the default seed for Lua's pseudorandom number generator, namely
    the output of time() and the heap address of the Lua state. A brute-force
    search based on math.random()-generated network traffic can reveal the ASLR
    base address of the process.

o [Security][NSE] In some non-standard builds (e.g. --without-openssl), NSE
  scripts were attempting to load missing Lua modules from the current working
  directory. Fixed by removing Lua's default package searchers, leaving only
  the existing nselib file fetcher.

o Added a libfuzzer-based framework for fuzzing internal functions of Nmap,
  Ncat, and Nping. So far, 10 functions have been instrumented and 3 minor
  issues have been fixed. [Daniel Miller]

o [GH#3523] Fixed an rare false-positive case in TCP Connect scan (-sT) where a
  failed connect() may leave SO_ERROR set to 0 even though an ICMP error has
  been received and select() has indicated the socket.

o [NSE] Introduced execution time and memory allocation limits for NSE scripts.
  Script threads that run for more than 5 seconds without yielding (e.g.
  calling a socket operation) will be killed. Memory allocations beyond 400MB
  will throw an error. Specific limits may be changed in the future.

o [NSE] Added 8 new scripts, for a total of 620 NSE scripts, all for auditing
  DICOM (medical imaging) services:

  + dicom-info fingerprints a DICOM SCP via A-ASSOCIATE, reporting its
    Implementation Class UID and Version Name, accepted SOP classes and
    transfer syntaxes, max PDU and protocol version; over TLS it also reports
    the server certificate (key type/size, signature algorithm, with weak-
    crypto and self-signed flags) and the mutual-TLS / client-certificate
    posture. [Paulino Calderon]

  + dicom-cfind-ls performs C-FIND queries to enumerate studies and series and
    the patient-level metadata an archive returns, flagging unauthenticated
    query access. [Paulino Calderon]

  + dicom-cmove exercises C-MOVE to test whether stored studies can be
    retrieved to an arbitrary destination AE. [Paulino Calderon]

  + dicom-get retrieves instances over C-GET, performing SCP/SCU role
    negotiation so the retrieval actually completes, and reports
    unauthenticated read access. [Paulino Calderon]

  + dicom-store-fuzzer fuzzes the C-STORE service with a corpus of malformed
    datasets, classifying each response (accept, reject, timeout, reset,
    corrupt) and running a periodic C-ECHO health check to detect crashes
    mid-campaign. [Paulino Calderon]

  + dicom-store-inject tests whether an archive accepts an unauthenticated
    C-STORE by uploading a single clearly-synthetic Secondary Capture instance
    (fake patient, "safe to delete" markers, UIDs under the 2.25 arc) and
    reporting whether it was stored, refused, or the association was rejected;
    it prints the stored UIDs for cleanup. [Paulino Calderon]

  + dicom-web-enum enumerates DICOMweb (PS3.18) services over HTTP(S) --
    QIDO-RS, WADO-RS and STOW-RS -- classifying each as open, authentication-
    required or absent, reporting the study/patient metadata an unauthenticated
    client can read and flagging an open STOW-RS store (image-injection)
    surface. [Paulino Calderon]

  + dicom-slowloris probes for DICOM association-pool exhaustion (a slowloris-
    style DoS) in idle, C-ECHO keep-alive and partial-handshake modes,
    measuring a latency baseline, requiring repeated confirmation before
    declaring exhaustion, and reporting a graded verdict with recovery time.
    [Paulino Calderon]

o [Zenmap] Fixed crashes:
  - [GH#3497] configparser.DuplicateSectionError in Profile Editor
  - [GH#3431] KeyError: 'vl_6_logo'
  - [GH#3420] sqlite3.DatabaseError: database disk image is malformed

o [NSE] Expanded the dicom.lua library from a basic A-ASSOCIATE/C-ECHO helper
  into a full DIMSE toolkit. It now supports C-STORE, C-FIND, C-GET and
  C-MOVE; A-ASSOCIATE-RQ with multiple presentation contexts and SCP/SCU role
  negotiation (so C-GET sub-operations work); command-set and dataset build/
  parse in implicit and explicit VR; and DICOM-over-TLS transport (PS3.15,
  port 2762) selectable with the dicom.tls script-arg. [Paulino Calderon]

o [Ndiff][GH#3468] Fixed `make check-ndiff` to work with Python 3.12+ [gargamel778]

o [NSE][GH#3492] vulners API queries for versions like 4.100 were being
  truncated on the server, resulting in false positives. Fixed by encoding as
  string. [huuyafwww]

o [Ncat][GH#3489][GH#3498] Ncat in listen mode no longer sends termination
  signals to its process group. Ncat inherits the group of whatever launched
  it, so a SIGINT, SIGTERM, SIGHUP, or SIGQUIT could also terminate the
  caller's shell or test harness. The signal is now forwarded to the children
  Ncat started for connections when -k and cmdexec are both in effect. [MRX-72]

o [Nsock][GH#3449] Nsock no longer calls fatal() when encountering a
  pcap-related error. Instead, errors are propagated to the caller the same way
  other socket errors are handled.

o [GH#3438][GH#3511] Fixed warnings and crashes due to bind() failing on macOS
  and FreeBSD, as well as Nping probe failures. Error messages similar to:
  "mksock_bind_addr(): Bind to <IP>:0 failed (IOD #3): Invalid argument (22)"
  [Daniel Miller, MRX-72]

o [NSE] Added DHX2 authentication method to afp.lua [Daniel Miller]

o [NSE][GH#3536] Function ipOps.isPrivate() was incorrectly treating all IPv4
  addresses starting with 192.0.2x or 192.0.2xx as private. [Pasi Abe]

o [NSE] Function ipOps.expand_ip() now strips off any leading zeros from IPv4
  octets, returning "10.0.0.0", not "010.000.0.0", for input "010.000". This
  also resolves a bug where "010" was not recognized as a private IP address.
  [nnposter]

o [NSE][GH#3494] Malformed TPKT header could have caused parser infinite loop
  in library iec61850mms. Truncated data were silently ignored.
  [Zasnit1, nnposter]

o Prevent -iR from running forever if all addresses are excluded or if all
  available addresses have been scanned with --unique. The underlying addrset
  trie has been optimized for fast lookup and minimal memory use.

o [NSE][GH#3447] IP options parsing by the packet library no longer crashes
  on incomplete options. IP header data after EOOL are no longer parsed as
  options. [Ibrahim AlJaafreh, nnposter]

o [NSE][GH#3213] Rudimentary support for 802.1Q / 802.1ad VLAN tags [nnposter]
  - NSE packet.Frame:new() parses VLAN tags and captures the result in list
    frame.vlans. Each element is a table containing the expected fields:
    TPID, CPC, DEI, and VID (all in lowercase).
  - NSE packet.Frame:build_ether_frame() takes an an optional parameter
    in the form of the list above to build 802.1Q / 802.1ad headers.

o [NSE][GH#3456] Script http-config-backup was always failing. [h00die]

o [NSE][GH#3440] The rsync library was not correctly parsing server responses
  for protocol version 32. [h00die]

o [NSE][GH#3307] Script iec61850-mms was never executed due to a flawed
  portrule. [RyugaXhypeR]

o [NSE] Scripts http-config-backup and rsync-list-modules now provide XML
  output. [nnposter]

o Fixed a fatal error in traceroute with -sO: "Unknown protocol _: QUITTING."

o Made DNS TXID random, not sequential, in massdns.cc.

o [NSE][GH#3430] Nmap now tolerates TLS targets that do not send close_notify.
  [nnposter]

Fixed at 36aff17c77. Leaving open for SA.