nmap segmentation fault during NSE script scan of authorized target

TL;DR

A segfault during NSE means one script, or a corrupted script database, is crashing the whole engine rather than failing cleanly. Bisect by running version detection alone, then a single safe script, then script groups, and repair the install or exclude the one broken script so the authorized scan can finish.

nmap segmentation fault during NSE script scan of authorized target

Use this when

• nmap crashes with a segmentation fault as soon as -sC or a named script starts.
• Plain port scanning of the same in-scope host completes normally.

Not for this skill when

• A script prints an error and nmap finishes. That is a script logic fault to fix in the script arguments, not a segfault.
• The crash happens on every host including loopback with no scripts loaded. Suspect a broken binary or library first.

Steps

1. Reproduce minimally on one in-scope host: run a plain connect scan, then add -sV, then add one safe script such as http-title. Verify: Verify: you can name the exact step where the crash first appears.
2. Run with script tracing and debugging, nmap -d with --script-trace, and save the last script name printed before the fault. Verify: Verify: the log ends on the same script across two runs.
3. Refresh the script database with nmap --script-updatedb and check the nmap and OpenSSL versions for a mismatched local build. Verify: Verify: the database rebuild completes and nmap --version shows a coherent build.
4. Reinstall nmap from the distro package or rebuild it, then rerun the failing script alone against the authorized host. Verify: Verify: the single-script run finishes and writes normal output.
5. If one community script still crashes, exclude it with --script excluding that name, note the gap in coverage, and report the crash upstream with the trace. Verify: Verify: the full scan completes and the engagement log records the excluded script.

Variant phrasings

nmap crashes when running vuln scripts segfault

The category-level phrasing when -sC or vuln scripts trigger it.

nmap script scan core dumped linux

The shell-message phrasing from the tester box.

one nse script crashes whole nmap scan

The isolation phrasing after bisecting.

Compatibility: Compatibility: nmap 7.x NSE on Linux; package reinstall steps assume a distro or official build, not a hand-patched fork.

Why it happens

NSE scripts run inside one process, so a native crash in a library a script loads, or a corrupt compiled script entry, takes nmap down with it. The port scan core is usually healthy; the fault surface grows only when the script engine loads that specific script and its dependencies.

Edge cases / pitfalls

• Do not debug by scanning harder: one host, one script, minimal ports keeps the authorized target load low.
• A segfault after a distro upgrade often means a stale locally built nmap is picking up new system libraries; check which binary the shell resolves.
• Keep the core dump and the exact command line; both belong in the upstream report and the engagement notes.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_jVToOdYfj6xEN5dHXfeOHg