Zenmap full changelog

Fixed a regression which prevented most scripts in the version category from running.
Updated Ncat's ca-bundle.crt.
Fix Zenmap's handling of multiple osclass elements in Nmap XML. Previously, each subsequent osclass in a host would overwrite the previous osclass. [Derek Martin]

Upgraded included libraries:
Source: libpcap 1.10.7, pcre2 10.49, lua 5.4.9, libdnet 1.18.2
Binary installers: OpenSSL 3.5.9, Python 3.14.8
[Windows]Upgraded the included version of Npcap from 1.88 to 1.89, resolving one crash and upgrading to libpcap 1.10.7. See https://npcap.com/changelog
[Security][NSE]Karan Bamal of SentinelOne reported the following issues with NSE scripts and libraries, which have all been fixed:
afp.lua used a hardcoded DH private exponent, so that credentials passed via command line could be decrypted from network traffic. The DHCAST128 UAM is known to be cryptographically broken, and has been replaced in this release with DHX2.
Redirect to unverified URL in anyconnect.lua and upnp.lua
Unbounded memory consumption in rpc.lua, drda.lua, eigrp.lua, msrpctypes.lua, db2-das-info, and dns-zone-transfer
Uninterruptible CPU usage (infinite loop) not subject to --script-timeout or --host-timeout in rdp.lua, tn3270.lua, and ospf.lua
Infinite loop waiting for errored coroutines in tftp.lua, effectively mitigated by --script-timeout
[Security]Zach Hanley of Horizon3.ai, in collaboration with Claude and Anthropic Research, reported three issues, which have all been fixed:
Two distinct use-after-free bugs in massdns parallel DNS resolver.
NSE uses the default seed for Lua's pseudorandom number generator, namely the output of time() and the heap address of the Lua state. A brute-force search based on math.random()-generated network traffic can reveal the ASLR base address of the process.
[Security][NSE]In some non-standard builds (e.g. --without-openssl), NSE scripts were attempting to load missing Lua modules from the current working directory. Fixed by removing Lua's default package searchers, leaving only the existing nselib file fetcher.
Added a libfuzzer-based framework for fuzzing internal functions of Nmap, Ncat, and Nping. So far, 10 functions have been instrumented and 3 minor issues have been fixed. [Daniel Miller]
[GH#3523]Fixed an rare false-p

[SECURITY]Rebuilt the Windows self-installer with NSIS 3.11, addressing CVE-2025-43715--a race condition in earlier NSIS versions that could allow local attackers to escalate to SYSTEM privileges when a vulnerable installer is run as SYSTEM. The Nmap installer does not run as SYSTEM by default.
Upgraded included libraries: OpenSSL 3.0.17, Lua 5.4.8
[Windows]Upgraded the included version of Npcap from 1.82 to 1.83, improving compatibility with PPPoE connections. See https://npcap.com/changelog
[macOS][GH#3127]Fix "dnet: Failed to open device en0" errors on macOS since Nmap 7.96. [Daniel Miller]
Fixed an issue in FTP bounce scan where a single null byte is written past the end of the receive buffer. The issue is triggered by a malicious server but does not cause a crash with default builds. [Tyler Zars]
[GH#3130]Fix a crash (stack exhaustion due to excessive recursion) in the parallel DNS resolver. Additionally, improved performance by processing responses that come after the request has timed out. [Daniel Miller]
[GH#2148]Fix the error, "Assertion failed: (datalink == DLT_EN10MB), function begin_sniffer, file scan_engine_raw.cc" when using Nmap with certain VPN interfaces. [Daniel Miller]
[GH#2757]Fix a crash in traceroute when using randomly-generated decoys: "Assertion `source->ss_family == AF_INET' failed" [Daniel Miller]
[GH#2899]When IP protocol scanning on IPv6 (-sO -6), skip protocol numbers that are registered as Extension Header values. When the --data option was used, these would fail the assertion "len == (u32) ntohs(ip6->ip6_plen)" [Daniel Miller]
[GH#3086]Prevent TCP Connect scan (-sT) from leaking one socket per hostgroup, which led to progressively slower scans and assertion failures in other scan phases. [Daniel Miller]
[NSE][GH#3133]Fix the error "nse_nsock.cc:637: void receive_callback(nsock_pool, nsock_event, void*): Assertion `lua_status(L) == 1' failed." when reading from an SSL connection.

Fixed an issue with the parallel forward DNS resolver: it had not been consulting /etc/hosts, nor did it correctly handle the 'localhost' name.

[NSE][GH#2136][GH#2137] Rectify error "time result cannot be represented..." in the AFP library. [Clément Notin]
[NSE][GH#1473] It is now possible to control whether the SNMP library uses v1 (default) or v2c by setting script argument snmp.version. [nnposter] o [NSE][GH#2128] MySQL library was not properly parsing server responses, resulting in script crashes. [nnposter]
[NSE] Script mysql-audit now defaults to the bundled mysql-cis.audit for the audit rule base. [nnposter]

[Windows] The Npcap Windows packet capturing library (https://npcap.org/) is faster and more stable than ever. Nmap 7.80 updates the bundled Npcap from version 0.99-r2 to 0.9982, including all of these changes from the last 15 Npcap releases: https://nmap.org/npcap/changelog
[NSE] Added 11 NSE scripts, from 8 authors, bringing the total up to 598! They are all listed at https://nmap.org/nsedoc/, and the summaries are below:
[GH#1232] broadcast-hid-discoveryd discovers HID devices on a LAN by sending a discoveryd network broadcast probe. [Brendan Coles]
[GH#1236] broadcast-jenkins-discover discovers Jenkins servers on a LAN by sending a discovery broadcast probe. [Brendan Coles]
[GH#1016][GH#1082] http-hp-ilo-info extracts information from HP Integrated Lights-Out (iLO) servers. [rajeevrmenon97]
[GH#1243] http-sap-netweaver-leak detects SAP Netweaver Portal with the Knowledge Management Unit enabled with anonymous access. [ArphanetX]