nmap: nse_nsock.cc:342: void status(lua_State*, nse_status): Assertion `lua_stat us(L) == LUA_YIELD' failed.

[marek22k]

Describe the bug
nmap crashes

To Reproduce
Run nmap

Expected behavior
No crash

Version info (please complete the following information):

• OS: Debian 13
• Output of nmap --version:

Nmap version 7.98SVN ( https://nmap.org )
Platform: x86_64-unknown-linux-gnu
Compiled with: liblua-5.4.7 openssl-3.5.1 libssh2-1.11.1 libz-1.3.1 libpcre2-10.46 libpcap-1.10.5 nmap-libdnet-1.18.0 ipv6
Compiled without:
Available nsock engines: epoll poll select

commit fcf6f0cb19e829720faa9f5ace506a582253104b (HEAD -> master, origin/master, origin/HEAD)
Author: nnposter <nnposter@e0a8ed71-7df4-0310-8962-fdc924857419>
Date:   Wed Oct 8 23:08:04 2025 +0000

    Use simpler/cheaper portrule

Additional context

nmap \
    -PS22,53,80 \
    -PU53 \
    -PE \
    -sS \
    -sU \
    -p U:53,69,123,161-162,443,514,520-521,547,33434-33436,T:7,9,13,17,19-23,25,37,43,53,69-70,79-80,88,110,115,119,123,143,161-163,179,194,300,389,443,465,513,520-521,540,547,563,587,631,636,655,747,853,873,989-990,992-993,995,1080,1194,1521,1688,1723,1900,1958,1965,2049,2086,2181,2200,2222,2375-2376,2759,2947,3128,3306,3478,3690,3978-3979,4500,4949,5000-5001,5072,5201,5222-5223,5269,5280,5353,5432,5500,5555,5699,5800-5801,5900-5901,6379,6443,6665-6669,6679,6696-6697,6924,7000-7001,7591,7777,8008,8044,8053-8054,8080-8081,8101,8118,8123,8291,8333,8443,8448,8808,9001,9030,9050-9051,9090,9100,9150,9418,9800,10000-10001,10250,11211,15000,16379,25565,26379,27015,27017,28801,30000,33434-33436,34197,51820,64738 \
    -sV \
    -O \
    --version-light \
    --traceroute \
    --script "(default or safe or discovery or version or vuln) and not (brute or dos or external or fuzzer or broadcast or broadcast-* or multicast-* or targets-*) or targets-traceroute" \
    --script-args "targets-traceroute.newtargets" \
    --max-rtt-timeout 1250ms \
    --initial-rtt-timeout 250ms \
    --max-retries 3 \
    --host-timeout 15m \
    --script-timeout 10m \
    --max-scan-delay 2s \
    --min-hostgroup 64 \
    --min-rate 2000 \
    -oN 2025_10_12_ipv6_dn42_port_scan.nmap \
    -oX 2025_10_12_ipv6_dn42_port_scan.xml \
    -oS 2025_10_12_ipv6_dn42_port_scan.snmap \
    -oG 2025_10_12_ipv6_dn42_port_scan.gnmap \
    --noninteractive \
    -6 \
    -iL addresses.txt

results in

Unexpected error 13 (Permission denied) in NSE_TYPE_READ callback - aborting thi
s service                                                                       Unexpected error 13 (Permission denied) in NSE_TYPE_READ callback - aborting thi
s service                                                                       Unexpected error 13 (Permission denied) in NSE_TYPE_READ callback - aborting thi
s service                                                                       Unexpected error 13 (Permission denied) in NSE_TYPE_READ callback - aborting thi
s service                                                                       Unexpected error 13 (Permission denied) in NSE_TYPE_READ callback - aborting thi
s service           
Unexpected error 13 (Permission denied) in NSE_TYPE_READ callback - aborting thi
s service           
Unexpected error 13 (Permission denied) in NSE_TYPE_READ callback - aborting thi
s service           
nmap: nse_nsock.cc:342: void status(lua_State*, nse_status): Assertion `lua_stat
us(L) == LUA_YIELD' failed.             
Aborted (core dumped)

[marek22k]

Related: #1837 (comment)

[nnposter]

Please re-run the scan with option -d and post the stack trace.

[marek22k]

Unfortunately, I couldn't reproduce the behavior; perhaps the behavior has changed in the network or something.

[CrypticGuru]

I was reliably able to reproduce this issue (or one VERY similar to this).

TLDR: This error occured with the combination of the -oX, -sV and --max-rate flags.
(omitting any one of these flags resulted in a successful scan)

This command failed multiple times in a row: nmap -oX - -sV -p 80,443 --max-rate 500 REDACTED and produced output something like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.97 scan initiated Mon Dec  1 09:25:35 2025 as: nmap -oX - -sV -p 80,443 -&#45;max-rate 500 REDACTED -->
<nmaprun scanner="nmap" args="nmap -oX - -sV -p 80,443 -&#45;max-rate 500 REDACTED" start="1764606335" startstr="Mon Dec  1 09:25:35 2025" version="7.97" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="2" services="80,443"/>
<verbose level="0"/>
<debugging level="0"/>
<hosthint><status state="up" reason="unknown-response" reason_ttl="0"/>
<address addr="REDACTED" addrtype="ipv4"/>
<hostnames>
<hostname name="REDACTED" type="user"/>
</hostnames>
</hosthint>
nmap: nse_nsock.cc:637: void receive_callback(nsock_pool, nsock_event, void*): Assertion `lua_status(L) == LUA_YIELD' failed.
Aborted (core dumped)

When running the same command with the -d flag added, the last few lines of the output are as follows:

</hosthint>
<taskend task="Ping Scan" time="1764606306" extrainfo="1 total hosts"/>
<taskbegin task="Parallel DNS resolution of 1 host." time="1764606306"/>
<taskend task="Parallel DNS resolution of 1 host." time="1764606307"/>
<taskbegin task="SYN Stealth Scan" time="1764606307"/>
<taskend task="SYN Stealth Scan" time="1764606307" extrainfo="2 total ports"/>
<taskbegin task="Service scan" time="1764606307"/>
<taskend task="Service scan" time="1764606319" extrainfo="2 services on 1 host"/>
<taskbegin task="NSE" time="1764606319"/>
nmap: nse_nsock.cc:637: void receive_callback(nsock_pool, nsock_event, void*): Assertion `lua_status(L) == LUA_YIELD' failed.
Aborted (core dumped)

EDIT/UPDATE:

I was able to reproduce the problem without XML output, like this: nmap -d -sV -p 80,443 --max-rate 500 REDACTED.
Which produced this output:

Starting Nmap 7.97 ( https://nmap.org ) at 2025-12-01 09:36 -0700
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 500 
---------------------------------------------
NSE: Using Lua 5.4.
NSE: Arguments from CLI: 
NSE: Loaded 48 scripts for scanning.
mass_dns: Using DNS server 127.0.0.53
Initiating Parallel DNS resolution of 1 host. at 09:36
mass_dns: 0.00s 0/2 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 2]
Completed Parallel DNS resolution of 1 host. at 09:36, 0.00s elapsed
DNS resolution of 2 IPs took 0.00s. Mode: Async [#: 1, OK: 2, NX: 0, DR: 0, SF: 0, TR: 2, CN: 0]
Initiating Ping Scan at 09:36
Scanning REDACTED (REDACTED) [4 ports]
Packet capture filter (device eth0): dst host REDACTED and (icmp or icmp6 or ((tcp or udp or sctp) and (src host REDACTED)))
We got a TCP ping packet back from REDACTED port 443 (trynum = 0)
Completed Ping Scan at 09:36, 0.01s elapsed (1 total hosts)
Overall sending rates: 396.04 packets / s, 15049.50 bytes / s.
Initiating Parallel DNS resolution of 1 host. at 09:36
Completed Parallel DNS resolution of 1 host. at 09:36, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 09:36
Scanning REDACTED (REDACTED) [2 ports]
Packet capture filter (device eth0): dst host REDACTED and (icmp or icmp6 or ((tcp or udp or sctp) and (src host REDACTED)))
Discovered open port 80/tcp on REDACTED
Discovered open port 443/tcp on REDACTED
Completed SYN Stealth Scan at 09:36, 0.01s elapsed (2 total ports)
Overall sending rates: 153.07 packets / s, 6735.04 bytes / s.
Initiating Service scan at 09:36
Scanning 2 services on REDACTED (REDACTED)
Completed Service scan at 09:36, 12.05s elapsed (2 services on 1 host)
NSE: Script scanning REDACTED.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 09:36
NSE: Starting http-trane-info against REDACTED (REDACTED:80).
NSE: Starting http-trane-info against REDACTED (REDACTED:443).
NSE: Starting hnap-info against REDACTED (REDACTED:443).
NSE: Starting https-redirect against REDACTED (REDACTED:80).
NSE: Starting vmware-version against REDACTED (REDACTED:80).
NSE: Starting hnap-info against REDACTED (REDACTED:80).
NSE: Starting vmware-version against REDACTED (REDACTED:443).
NSE: [http-trane-info REDACTED:80] HTTP: Host returns 301 Moved Permanently instead of 404 File Not Found.
NSE: Finished https-redirect against REDACTED (REDACTED:80).
NSE: [vmware-version REDACTED:80] Couldn't download file: /sdk
NSE: Finished vmware-version against REDACTED (REDACTED:80).
NSE: [hnap-info REDACTED:80] HTTP: Host returns 301 Moved Permanently instead of 404 File Not Found.
NSE: Finished http-trane-info against REDACTED (REDACTED:80).
NSE: Finished hnap-info against REDACTED (REDACTED:80).
nmap: nse_nsock.cc:637: void receive_callback(nsock_pool, nsock_event, void*): Assertion `lua_status(L) == LUA_YIELD' failed.
Aborted (core dumped)

[nnposter]

@CrypticGuru Your failed assertion is different from the OP. The issue is possibly the same as #3133, already rectified in Nmap 7.98.

[rg-atte]

I think I managed to hit the same assertion as OP but not sure if the rest of the output is the same. Reduced the reproduction to the following options

sudo nmap -p8443 -T4 -Pn --version-trace -d --script vmware-version,http-trane-info TARGET

NSE: Loaded 2 scripts for scanning.
NSE: Loaded '/usr/bin/../share/nmap/scripts/http-trane-info.nse'.
NSE: Loaded '/usr/bin/../share/nmap/scripts/vmware-version.nse'.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 11:06
Completed NSE at 11:06, 0.00s elapsed
Initiating SYN Stealth Scan at 11:06
Scanning REDACTED [1 port]
Packet capture filter (device ens192): dst host REDACTED and (icmp or icmp6 or ((tcp or udp or sctp) and (src host REDACTED)))
Discovered open port 8443/tcp on REDACTED
Changing ping technique for REDACTED to tcp to port 8443; flags: S
Changing global ping host to REDACTED.
Completed SYN Stealth Scan at 11:06, 0.03s elapsed (1 total ports)
Overall sending rates: 35.71 packets / s, 1571.32 bytes / s.
NSE: Script scanning REDACTED.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 11:06
NSE: Starting http-trane-info against REDACTED:8443.
NSOCK INFO [0.0850s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK INFO [0.1160s] nsock_connect_ssl(): SSL connection requested to REDACTED:8443/tcp (IOD #1) (timeout: 1000ms) EID 9
NSE: Starting vmware-version against REDACTED:8443.
NSOCK INFO [0.1160s] nsock_iod_new2(): nsock_iod_new (IOD #2)
NSOCK INFO [0.1160s] nsock_connect_ssl(): SSL connection requested to REDACTED:8443/tcp (IOD #2) (timeout: 1000ms) EID 17
NSOCK INFO [0.2870s] nsock_trace_handler_callback(): Callback: SSL-CONNECT SUCCESS for EID 9 [REDACTED:8443]
NSOCK INFO [0.2880s] nsock_write(): Write request for 179 bytes to IOD #1 EID 27 [REDACTED:8443]
NSOCK INFO [0.2880s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 27 [REDACTED:8443]
NSOCK INFO [0.3200s] nsock_trace_handler_callback(): Callback: SSL-CONNECT SUCCESS for EID 17 [REDACTED:8443]
NSOCK INFO [0.3200s] nsock_read(): Read request from IOD #1 [REDACTED:8443] (timeout: 7000ms) EID 34
NSOCK INFO [0.3200s] nsock_write(): Write request for 621 bytes to IOD #2 EID 43 [REDACTED:8443]
NSOCK INFO [0.3210s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 43 [REDACTED:8443]
NSOCK INFO [0.3700s] nsock_read(): Read request from IOD #2 [REDACTED:8443] (timeout: 7000ms) EID 50
NSOCK INFO [0.6160s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 34 [REDACTED:8443] (448 bytes)
NSOCK INFO [0.6210s] nsock_iod_delete(): nsock_iod_delete (IOD #1)
NSE: [http-trane-info REDACTED:8443] Final http cache size (0 bytes) of max size of 1000000
NSE: [http-trane-info REDACTED:8443] HTTP: Host returns 301 Moved Permanently instead of 404 File Not Found.
NSOCK INFO [0.6210s] nsock_iod_new2(): nsock_iod_new (IOD #3)
NSOCK INFO [0.6220s] nsock_connect_ssl(): SSL connection requested to REDACTED:8443/tcp (IOD #3) (timeout: 1000ms) EID 57
NSOCK INFO [0.7890s] nsock_trace_handler_callback(): Callback: SSL-CONNECT SUCCESS for EID 57 [REDACTED:8443]
NSOCK INFO [0.7900s] nsock_write(): Write request for 165 bytes to IOD #3 EID 67 [REDACTED:8443]
NSOCK INFO [0.7900s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 67 [REDACTED:8443]
NSOCK INFO [0.8390s] nsock_read(): Read request from IOD #3 [REDACTED:8443] (timeout: 7000ms) EID 74
NSOCK INFO [1.1450s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 50 [REDACTED:8443] (603 bytes)
NSOCK INFO [1.1920s] nsock_read(): Read request from IOD #2 [REDACTED:8443] (timeout: 7000ms) EID 82
NSOCK INFO [1.1920s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 82 [REDACTED:8443] (31744 bytes)
NSOCK INFO [1.2410s] nsock_read(): Read request from IOD #2 [REDACTED:8443] (timeout: 7000ms) EID 90
NSOCK INFO [1.2410s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 90 [REDACTED:8443] (111104 bytes)
NSOCK INFO [1.2910s] nsock_read(): Read request from IOD #2 [REDACTED:8443] (timeout: 7000ms) EID 98
NSOCK INFO [1.2920s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 98 [REDACTED:8443] (95232 bytes)
NSOCK INFO [1.3410s] nsock_read(): Read request from IOD #2 [REDACTED:8443] (timeout: 7000ms) EID 106
NSOCK INFO [1.3410s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 106 [REDACTED:8443] (396800 bytes)
NSOCK INFO [1.3910s] nsock_read(): Read request from IOD #2 [REDACTED:8443] (timeout: 7000ms) EID 114
NSOCK INFO [1.3910s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 114 [REDACTED:8443] (595456 bytes)
NSOCK INFO [1.4410s] nsock_read(): Read request from IOD #2 [REDACTED:8443] (timeout: 7000ms) EID 122
NSOCK INFO [1.4410s] do_actual_read(): SSL_read() failed for reason error:00000001:lib(0)::reason(1) on NSI 2
NSOCK INFO [1.4410s] nsock_trace_handler_callback(): Callback: READ ERROR [Input/output error (5)] for EID 122 [REDACTED:8443]
nmap: nse_nsock.cc:342: void status(lua_State*, nse_status): Assertion `lua_status(L) == LUA_YIELD' failed.
Aborted

The issue doesn't happen when the scripts are ran separately or if either script is ran with some other script (based on my limited testing). Just when vmware-version and http-trane-info are in the same scan (this includes -sV).

Target is a http server running Apache 2.4.6 and PHP 7.4.33 with an expired cert.

[rg-atte]

I did some bisecting and I believe this assertion issue was introduced in commit 92d5b6a while commits from 3a0db5d to 1264a6e hang for the same target.