Nmap IPv6 Extension Header Length Wrap — Process Crash or Unexpected Child

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•5

Detects nmap processes performing IPv6 scans (using flags such as -6) that result in abnormal process termination or the spawning of unexpected child processes (e.g., cmd.exe, sh, bash). This behavior is indicative of exploitation attempts targeting the nmap IPv6 extension header length integer wrap vulnerability, including the execution of associated PoC harness binaries.