CVE-2026-58058

Name	CVE-2026-58058
Description	Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1140916

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nmap (PTS)	bullseye	7.91+dfsg1+really7.80+dfsg1-2	vulnerable
	bookworm	7.93+dfsg1-1	vulnerable
	trixie	7.95+dfsg-3	vulnerable
	forky, sid	7.99+dfsg-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nmap	source	(unstable)	(unfixed)			1140916

Notes

https://github.com/bikini/exploitarium/tree/main/nmap-ipv6-extlen-wrap-poc
https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83