1.4 KiB
UNDF: UNDF-2026-000000187
nmap — CWE-407 scan result: CLEAN (beyond nmap-0001)
Scan date: 2026-03-27 Files scanned:
scan_engine.cc(probe management)osscan2.cc(OS fingerprint matching)TargetGroup.cc(target resolution)FPEngine.cc(fingerprint engine)
Candidates Investigated
HostOsScanStats::getActiveProbe() — osscan2.cc
Linear scan through probesActive (std::list<OFProbe *>). Called up to
6 times per received packet inside processResp(), which runs in a do-while
loop per scan round. However, probesActive is bounded by the total number
of OS detection probe types: NUM_SEQ_SAMPLES=6 + TUI probes ≤ ~20. This is
a constant-bounded list — O(20) = O(1) in practice. Not a qualifying CWE-407.
UltraScanInfo::findHost() — scan_engine.cc
Uses std::multiset::find() with a comparator — O(log N), not O(N). Not a defect.
TargetGroup DNS resolution — TargetGroup.cc
std::find(nb_it, netblocks.end(), nb_old) inside a loop over DNS requests.
The iterator nb_it advances monotonically (never resets to begin()),
making the total scan cost O(B) across all iterations — amortized O(1) per
request. Not a defect.
osscan2.cc probe send loops
Multiple loops over probesActive (≤20 elements) and FPtests arrays
(NUM_FPTESTS=13). All bounded by compile-time constants. Not CWE-407.
Verdict: CLEAN beyond nmap-0001
No new CWE-407 defects found in the scanned files.