Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

A flaw was found in Nmap. A remote attacker or a scanned target can send a specially crafted IPv6 response with a truncated extension header. This can lead to an integer underflow, causing out-of-bounds reads and a denial of service (DoS) due to a crash during raw IPv6 scans.

Red Hat rates this flaw as Moderate rather than the AI-assigned Important severity. The Aegis AI-Bot rated UI:N (no user interaction), but nmap is a command-line scanning tool that an operator must manually invoke — initiating a scan is user interaction per the CVSS definition of UI:R. Correcting UI:N to UI:R reduces the CVSS from 7.5 to 6.5, aligning with the upstream CVEORG assessment. The vulnerability requires a scanned target or on-path attacker to return a crafted IPv6 response with a truncated extension header during a raw IPv6 scan. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Fix deferred nmap Red Hat Enterprise Linux 6 Fix deferred nmap Red Hat Enterprise Linux 7 Fix deferred nmap Red Hat Enterprise Linux 8 Fix deferred nmap Red Hat Enterprise Linux 9 Fix deferred nmap Red Hat OpenShift Container Platform 4 Fix deferred rhcos https://www.cve.org/CVERecord?id=CVE-2026-58058 https://nvd.nist.gov/vuln/detail/CVE-2026-58058 https://github.com/bikini/exploitarium/tree/main/nmap-ipv6-extlen-wrap-poc https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83 https://nmap.org/changelog.html https://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension-header-parsing