[rpms/nmap] f43: Fix CVE-2026-58058 (rhbz#2494410)

[rpms/nmap] f43: Fix CVE-2026-58058 (rhbz#2494410)

[Martin Osvald]

A new commit has been pushed.

Repo   : rpms/nmap
Branch : f43
Commit : 5ff19a0ee99c235d9f734f7138c5e99ee698e4bb
Author : Martin Osvald <mosvald@redhat.com>
Date   : 2026-07-01T12:29:45+02:00
Stats  : +28/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/nmap/c/5ff19a0ee99c235d9f734f7138c5e99ee698e4bb?branch=f43

Log:
Fix CVE-2026-58058 (rhbz#2494410)

---
diff --git a/nmap-CVE-2026-58058.patch b/nmap-CVE-2026-58058.patch
new file mode 100644
index 0000000..9cee66f
--- /dev/null
+++ b/nmap-CVE-2026-58058.patch
@@ -0,0 +1,25 @@
+commit bb6754e76bb1686315008e1aa1c40202a513fb83
+Author: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
+Date:   Thu Jun 25 21:58:49 2026 +0000
+
+    Fix extension header parsing. Credit: Himanshu Anand
+
+diff --git a/libnetutil/netutil.cc b/libnetutil/netutil.cc
+index 5a2daf187..ba7cfe71a 100644
+--- a/libnetutil/netutil.cc
++++ b/libnetutil/netutil.cc
+@@ -700,11 +700,13 @@ static const u8 *ipv6_get_data_primitive(const struct ip6_hdr *ip6, const u8 *pa
+   *nxt = ip6->ip6_nxt;
+   p += sizeof(*ip6);
+   while (p < end && ipv6_is_extension_header(*nxt)) {
+-    if (p + 2 > end)
++    if (p + 8 > end)
+       return NULL;
+     *nxt = *p;
+     p += (*(p + 1) + 1) * 8;
+   }
++  if (p >= end)
++    return NULL;
+ 
+   *len = end - p;
+   if (upperlayer_only && !ipv6_is_upperlayer(*nxt))

diff --git a/nmap.spec b/nmap.spec
index a642646..7ab8c8f 100644
--- a/nmap.spec
+++ b/nmap.spec
@@ -29,6 +29,9 @@ Patch8: nmap-pcre2.patch
 Patch9: nmap-ems-ssl-enum-ciphers.patch
 # Fix build with libpcap 1.10.5
 Patch10: nmap-libpcap.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2494410
+# https://github.com/nmap/nmap/commit/bb6754e
+Patch11: nmap-CVE-2026-58058.patch
 
 BuildRequires: automake make
 BuildRequires: autoconf