Packages / Debian 13 (Trixie) / net / nmap

Package: nmap (7.98+dfsg-1~bpo13+1)

The Network Mapper

Other Packages Related to nmap:

dep: [nmap-common] (= 7.98+dfsg-1~bpo13+1)
Architecture independent files for nmap
dep: [libc6] (>= 2.38)
GNU C Library: Shared libraries
dep: [libgcc-s1] (>= 3.0)
GCC support library
dep: [liblinear4] (>= 2.01+dfsg)
Library for Large Linear Classification
dep: [liblua5.4-0] (>= 5.4.6)
Shared library for the Lua interpreter version 5.4
dep: [libpcap0.8t64] (>= 1.5.1)
system interface for user-level packet capture
dep: [libpcre2-8-0] (>= 10.32)
New Perl Compatible Regular Expression Library- 8 bit runtime files
dep: [libssh2-1t64] (>= 1.11.0)
SSH2 client-side library
dep: [libssl3t64] (>= 3.0.0)
Secure Sockets Layer toolkit - shared libraries
dep: [libstdc++6] (>= 11)
GNU Standard C++ Library v3
dep: [zlib1g] (>= 1:1.1.4)
compression library - runtime

sug: [ncat]
NMAP netcat reimplementation
sug: [ndiff]
The Network Mapper - result compare utility
sug: [zenmap]
The Network Mapper Front End

Download nmap

Architecture	Package size	Installed size	Files	Package
amd64	1.9 MiB	4.5 MiB	list of files	Download
arm64	1.8 MiB	4.5 MiB	list of files	Download

Package file paths (22)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

/usr/bin/nmap
/usr/bin/nping
/usr/share/doc/nmap/changelog.Debian.gz
/usr/share/doc/nmap/changelog.gz
/usr/share/doc/nmap/copyright
/usr/share/lintian/overrides/nmap
/usr/share/man/de/man1/nmap.1.gz
/usr/share/man/es/man1/nmap.1.gz
/usr/share/man/fr/man1/nmap.1.gz
/usr/share/man/hr/man1/nmap.1.gz
/usr/share/man/hu/man1/nmap.1.gz
/usr/share/man/it/man1/nmap.1.gz
/usr/share/man/ja/man1/nmap.1.gz
/usr/share/man/man1/nmap.1.gz
/usr/share/man/man1/nping.1.gz
/usr/share/man/pl/man1/nmap.1.gz
/usr/share/man/pt_BR/man1/nmap.1.gz
/usr/share/man/pt/man1/nmap.1.gz
/usr/share/man/ro/man1/nmap.1.gz
/usr/share/man/ru/man1/nmap.1.gz
/usr/share/man/sk/man1/nmap.1.gz
/usr/share/man/zh/man1/nmap.1.gz

Field source: Debian 13 (Trixie) backports main amd64

Use this package

OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.

Try Debian 13 (Trixie) in the browser Build an image that includes nmap

Versions, suites, and repositories

Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.

Version	Release	Architecture	Repository	Package size	Installed size	Publisher repository artifact
7.98+dfsg-1~bpo13+1	trixie-backports / main	amd64	Debian 13 backports · main · amd64	1.9 MiB	4.5 MiB	pool/main/n/nmap/nmap_7.98+dfsg-1~bpo13+1_amd64.deb
7.98+dfsg-1~bpo13+1	trixie-backports / main	arm64	Debian 13 backports · main · arm64	1.8 MiB	4.5 MiB	pool/main/n/nmap/nmap_7.98+dfsg-1~bpo13+1_arm64.deb

Field source: Debian 13 (Trixie) backports main amd64

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE Severity Version impact

CVE	Severity	Version impact
[CVE-2026-72712] Published: Aug 11, 2026, 5:35:06 PM UTC Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option.	Medium(6.9)	Affected Details (2) `7.98+dfsg-1~bpo13+1` · amd64 · trixie-backports Affected nvd · nmap · debian · 13 `7.98+dfsg-1~bpo13+1` · arm64 · trixie-backports Affected nvd · nmap · debian · 13
[CVE-2026-58058] Published: Jun 28, 2026, 1:32:59 AM UTC Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-	Medium(6.9)	Affected Details (2) `7.98+dfsg-1~bpo13+1` · amd64 · trixie-backports Affected nvd · nmap · debian · 13 `7.98+dfsg-1~bpo13+1` · arm64 · trixie-backports Affected nvd · nmap · debian · 13
[CVE-2018-15173] Published: Aug 8, 2018, 12:29:00 AM UTC nmap: CVE-2018-15173	Medium(5.5)	Affected Details (2) `7.98+dfsg-1~bpo13+1` · amd64 · trixie-backports Affected dsa · nmap · debian · 13 `7.98+dfsg-1~bpo13+1` · arm64 · trixie-backports Affected dsa · nmap · debian · 13

[CVE-2026-72712]

Published: Aug 11, 2026, 5:35:06 PM UTC

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option.

Medium(6.9)

Affected

Details (2)

7.98+dfsg-1~bpo13+1 · amd64 · trixie-backports
Affected
nvd · nmap · debian · 13
7.98+dfsg-1~bpo13+1 · arm64 · trixie-backports
Affected
nvd · nmap · debian · 13

[CVE-2026-58058]

Published: Jun 28, 2026, 1:32:59 AM UTC

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-

Medium(6.9)

Affected

Details (2)

7.98+dfsg-1~bpo13+1 · amd64 · trixie-backports
Affected
nvd · nmap · debian · 13
7.98+dfsg-1~bpo13+1 · arm64 · trixie-backports
Affected
nvd · nmap · debian · 13

[CVE-2018-15173]

Published: Aug 8, 2018, 12:29:00 AM UTC

nmap: CVE-2018-15173

Medium(5.5)

Affected

Details (2)

7.98+dfsg-1~bpo13+1 · amd64 · trixie-backports
Affected
dsa · nmap · debian · 13
7.98+dfsg-1~bpo13+1 · arm64 · trixie-backports
Affected
dsa · nmap · debian · 13

Fixed and unaffected versions (3)

CVE Severity Version impact

CVE	Severity	Version impact
[CVE-2017-18594] Published: Aug 29, 2019, 12:15:00 AM UTC nmap: CVE-2017-18594	Medium(6.5)	Fixed Details (2) `7.98+dfsg-1~bpo13+1` · amd64 · trixie-backports Fixed · Fixed: `7.80+dfsg1-1` dsa · nmap · debian · 13 `7.98+dfsg-1~bpo13+1` · arm64 · trixie-backports Fixed · Fixed: `7.80+dfsg1-1` dsa · nmap · debian · 13
[CVE-2018-1000161] Published: Apr 18, 2018, 7:29:00 PM UTC nmap: CVE-2018-1000161	Medium	Fixed Details (2) `7.98+dfsg-1~bpo13+1` · amd64 · trixie-backports Fixed · Fixed: `7.70+dfsg1-1` dsa · nmap · debian · 13 `7.98+dfsg-1~bpo13+1` · arm64 · trixie-backports Fixed · Fixed: `7.70+dfsg1-1` dsa · nmap · debian · 13
[CVE-2013-4885] Published: Oct 26, 2013, 5:55:03 PM UTC nmap: CVE-2013-4885	Medium	Fixed Details (2) `7.98+dfsg-1~bpo13+1` · amd64 · trixie-backports Fixed · Fixed: `6.40-0.1` dsa · nmap · debian · 13 `7.98+dfsg-1~bpo13+1` · arm64 · trixie-backports Fixed · Fixed: `6.40-0.1` dsa · nmap · debian · 13

[CVE-2017-18594]

Published: Aug 29, 2019, 12:15:00 AM UTC

nmap: CVE-2017-18594

Medium(6.5)

Fixed

Details (2)

7.98+dfsg-1~bpo13+1 · amd64 · trixie-backports
Fixed · Fixed: 7.80+dfsg1-1
dsa · nmap · debian · 13
7.98+dfsg-1~bpo13+1 · arm64 · trixie-backports
Fixed · Fixed: 7.80+dfsg1-1
dsa · nmap · debian · 13

[CVE-2018-1000161]

Published: Apr 18, 2018, 7:29:00 PM UTC

nmap: CVE-2018-1000161

Medium

Fixed

Details (2)

7.98+dfsg-1~bpo13+1 · amd64 · trixie-backports
Fixed · Fixed: 7.70+dfsg1-1
dsa · nmap · debian · 13
7.98+dfsg-1~bpo13+1 · arm64 · trixie-backports
Fixed · Fixed: 7.70+dfsg1-1
dsa · nmap · debian · 13

[CVE-2013-4885]

Published: Oct 26, 2013, 5:55:03 PM UTC

nmap: CVE-2013-4885

Medium

Fixed

Details (2)

7.98+dfsg-1~bpo13+1 · amd64 · trixie-backports
Fixed · Fixed: 6.40-0.1
dsa · nmap · debian · 13
7.98+dfsg-1~bpo13+1 · arm64 · trixie-backports
Fixed · Fixed: 6.40-0.1
dsa · nmap · debian · 13

Last synced: Oct 28, 2026, 3:14:19 AM UTC

[CVE catalog]

Checksums

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

7.98+dfsg-1~bpo13+1 / amd64Observed Sep 1, 2026sha256 332a63f94d18…8846fcc4Source-reported digest

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported digest (sha256): 332a63f94d18e109e3b66c3b26efa362da56a6b6f8a072ec95b04a3c8846fcc4

Verify download

printf '%s  %s\n' '332a63f94d18e109e3b66c3b26efa362da56a6b6f8a072ec95b04a3c8846fcc4' 'nmap_7.98+dfsg-1~bpo13+1_amd64.deb' | sha256sum --check --strict -

Field source: Debian 13 (Trixie) backports main amd64

7.98+dfsg-1~bpo13+1 / arm64Observed Sep 1, 2026sha256 bdc16357bb7d…c134eea2Source-reported digest

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported digest (sha256): bdc16357bb7d18a6415be74863615e3c8ae78648a18ec00b52ebd42dc134eea2

Verify download

printf '%s  %s\n' 'bdc16357bb7d18a6415be74863615e3c8ae78648a18ec00b52ebd42dc134eea2' 'nmap_7.98+dfsg-1~bpo13+1_arm64.deb' | sha256sum --check --strict -

Field source: Debian 13 (Trixie) backports main arm64

Sources

Debian 13 (Trixie) backports main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-backports-main-amd64:d39821bb4fc48252327fb05d82ee36a9b8a1446ae693561c7389741ccb0a2c7b
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie-backports/InRelease
Signed-object SHA-256
d76b03d2e95d41787657f3526c331993526b4b17f6cc09094b0675bcbf57dc7c
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
d39821bb4fc48252327fb05d82ee36a9b8a1446ae693561c7389741ccb0a2c7b
Observed SHA-256
d39821bb4fc48252327fb05d82ee36a9b8a1446ae693561c7389741ccb0a2c7b
Result
match verified
Debian 13 (Trixie) backports main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-backports-main-arm64:acf4939d14c5d5ed995554b7d34e1431dd020622de39cce80c0a28de73e15357
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie-backports/InRelease
Signed-object SHA-256
d76b03d2e95d41787657f3526c331993526b4b17f6cc09094b0675bcbf57dc7c
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
acf4939d14c5d5ed995554b7d34e1431dd020622de39cce80c0a28de73e15357
Observed SHA-256
acf4939d14c5d5ed995554b7d34e1431dd020622de39cce80c0a28de73e15357
Result
match verified
Debian 13 (Trixie) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Observed SHA-256
3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Result
match verified
Debian 13 (Trixie) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Observed SHA-256
753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Result
match verified