Baike.dev
All toolsAI codingTrendingOpen sourceNewsSubmit
Log in
Back to tool/Back to issues
#3492·nmap

vulners: Exim 4.100 is queried as version 4.1

Author: huuyafwwwCreated Sep 15, 2026Updated Sep 15, 2026

Describe the bug

Hi, and thank you for maintaining Nmap. While investigating CVEs reported for Exim 4.100, I found that vulners.nse sends version=4.100, but the API searches for 4.1. Nmap correctly identifies the service as 4.100; the version is lost during the API lookup.

With the current script, my loopback reproduction returned 52 CVEs. The same GET request with only version changed to %224.100%22 returned no matches and reported data.errorData.search_cpe as cpe:2.3:a:exim:exim:4.100:*:*:*:*:*:*:*.

To Reproduce

  1. Run this SMTP banner fixture in one terminal:
python
import socketserver

class SMTP(socketserver.BaseRequestHandler):
    def handle(self):
        self.request.settimeout(2)
        try:
            self.request.sendall(b"220 audit.local ESMTP Exim 4.100\r\n")
            while self.request.recv(8192):
                self.request.sendall(b"250 audit.local\r\n")
        except OSError:
            pass

class Server(socketserver.ThreadingTCPServer):
    allow_reuse_address = True
    daemon_threads = True

with Server(("127.0.0.1", 2525), SMTP) as server:
    server.serve_forever()
  1. From a checkout of nmap/nmap, run:
bash
nmap -sT -sV --version-light -Pn -n -p 2525   --script "$PWD/scripts/vulners.nse" --script-trace 127.0.0.1

The trace contains version=4.100, but the API response contains:

json
"search_explain": {
  "search_cpe": "cpe:2.3:a:exim:exim:4.1:*:*:*:*:*:*:*",
  "matched_cpe": "cpe:2.3:a:exim:exim:4.1:*:*:*:*:*:*:*"
}

Expected behavior

Look up the exact version string 4.100, retaining its trailing zeros.

Version info (please complete the following information):

  • OS: macOS 26.6.2, arm64.
  • Script: scripts/vulners.nse at cd6ddce888f6920e0acb88000555de12ba554029, byte-identical to SVN trunk when checked on 2026-09-15.
  • Output of nmap --version:
Nmap version 7.991 ( https://nmap.org )
Platform: arm-apple-darwin25.6.0
Compiled with: nmap-liblua-5.4.8 openssl-3.6.4 libssh2-1.11.1 libz-1.2.12 libpcre2-10.48 nmap-libpcap-1.10.6 nmap-libdnet-1.18.0 ipv6
Compiled without:
Available nsock engines: kqueue poll select
  • Relevant loopback entry from nmap --iflist (other interfaces omitted):
DEV       (SHORT)     IP/MASK       TYPE        UP   MTU
lo0       (lo0)       127.0.0.1/8   loopback    up   16384

Additional context

Serializing the version as a JSON string before URL encoding preserves it while retaining GET requests. I submitted the same correction to the separately maintained plugin: https://github.com/vulnersCom/nmap-vulners/pull/72.

Source: nmap/nmap

View original on GitHubView discussion on GitHub