Nmap 7.991

Fixed a memory-consumption hang in Ncat's HTTP proxy code that affected both connect and listen modes, reported by kumama_nui. Patched our included libssh2 source with upstream fixes for CVE-2025-15661, CVE-2026-7598, CVE-2026-55199, CVE-2026-55200, CVE-2026-58050, and CVE-2026-58051. The version number has been annotated as 1.11.1_NMAP1 [Zenmap] [GH#3347]Fixed several issues leading to crashes when parsing, editing, or saving command profiles containing '%' characters. [NSE] [GH#2272] smb-enum-shares failed to produce output for valid shares when an error was encountered on one share. [GH#3410]Fixed an issue where DNS resolution would incorrectly fail to match the same name in a different case. [NSE] [GH#1066]Added service names for SSL-protected services like amt-soap-https to portrules for several scripts, ensuring they run on these as well as the standard unencrypted services. Audited and converted most instances of strcat, strcpy, and sprintf to use bounded functions instead. [NSE] [GH#2221] mysql-dump-hashes now uses the correct column name for MySQL 5.7+ [NSE] [GH#2238] http-referer-checker was incorrectly fetching off-host URLs. Now only URLs on the target are fetched. [GH#2122]When an interface is specified with -e, also bind to the IP address for that device so that it works for non-Linux systems and non-root users. [Nsock] [GH#1939]When nsock_iod_set_localaddr() is used, nsock_connect_*() will now treat errors in bind(2) as connection failure. [GH#2732]Fix a potential crash on 32-bit platforms in debug mode due to incorrect format specifier for 64-bit integer type. [Christopher Chavez] [GH#3201] [GH#3367]Increase line length limit for nmap-service-probes and correctly handle lines that are too long. [@liquidpele, Ashutosh Kumar Singh] [GH#3414]Avoid out-of-bounds read when parsing PTR domain names. [@toor11 (Juri)] [GH#2245]Ensure variables updated by signal handlers are volatile sig_atomic_t. [Ncat] [GH#1410]Fix an assertion failure (count <= INT_MAX) in ncat -lk in some cases where stdin or a listening socket produces an error. [NSE] [GH#1946]Fix a cryptic error in smb-enum-services, "Server returned less data than needed for header" when smb.start_smb() failed. Fixed an issue with parsing nmap-service-probes that could cause a corrupted file to crash Nmap. Reported by Muhammed Hussein. [NSE] [GH#2016]Removed hostmap-bfk.nse, since the service it used shut down. Fixed several issues reported by Himanshu Anand: infinite loop in TCP options parsing and out-of-bounds memory read in IPv4 OS detection; integer underflow in IPv6 extension header processing; and undefined behavior in DNS label parsing. [GH#2721]Added checks for returned pointers from OpenSSL allocation functions. [GH#1546]Fix an incorrect assertion "timeout / 1000 <= (long) o.scan_delay" in traceroute which failed for timeouts greater than 1 second when there was no scan delay. [GH#3175]The --stats-every option can now be used in conjunction with --noninteractive. Previously, no stats messages were printed if a TTY was not attached. [GH#3375]Nmap can now be built with OpenSSL 4.0 [Nping] [GH#1751]The --rate option will not accept a rate higher than 1000 packets per second, since Nsock timers have millisecond resolution. Use --delay 0 for unlimited rate. [Nping]Fixed several issues with Nping in IPv6 mode including: [GH#1261]Incorrect BPF generated leading to "expression rejects all packets" [GH#3215]Incorrect constant used to check for IP version in Echo Server [NSE] [GH#3368]Fixed an out-of-memory issue in packet.lua when parsing a zero-length TCP header option. [Maxim Suhanov] Fixed an issue where Nmap OS scan trusts a packet's ip_len to size a CRC32 computation over TCP RST payload data, which may result in reading arbitrary heap data. Reported by Michael Bommarito. [Ncat] [GH#3005]Correctly report listening port number. ncat -l -p 0 will cause Ncat to listen on an ephemeral port, but it was reporting itself as listening on port 0. [Ncat] [GH#1672]F