{"id":"GHSA-2fjw-whxm-9v4q","aliases":["RUSTSEC-2025-0126"],"status":"published","title":"libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)","description":"A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::with_page_size constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-of-bounds writes during batch initialization.\n\nThe flaw was fixed in commit 94a286f by adding an overflow check:\n```Rust\nbatch_page_size\n    .checked_add(crate::nft_nlmsg_maxsize())\n    .expect(\"batch_page_size is too large and would overflow\");\n```","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2025-10-18T12:00:00Z","modified":"2025-12-01T16:20:48Z","fixes":[{"ecosystem":"crates.io","package":"nftnl","fixed_in":["0.9.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"nftnl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.8.0"},{"fixed":"0.9.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"nftnl","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"nftnl","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.9.0"}]}]}],"references":[{"url":"https://github.com/mullvad/nftnl-rs/issues/76#issue-3528876468","tags":["web","report"]},{"url":"https://github.com/mullvad/nftnl-rs/commit/94a286f87e88f431913d19668246de9006790125","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0126.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2fjw-whxm-9v4q"},{"url":"https://github.com/mullvad/nftnl-rs","tags":["package"]},{"url":"https://crates.io/crates/nftnl","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2fjw-whxm-9v4q","title":"libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)","description":"A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::with_page_size constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-of-bounds writes during batch initialization.\n\nThe flaw was fixed in commit 94a286f by adding an overflow check:\n```Rust\nbatch_page_size\n    .checked_add(crate::nft_nlmsg_maxsize())\n    .expect(\"batch_page_size is too large and would overflow\");\n```","status":"published","published":"2025-11-25T23:18:37Z","modified":"2025-12-01T16:04:57Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:39:11.110487Z"}],"osv":[{"id":"GHSA-2fjw-whxm-9v4q","title":"libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)","description":"A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::with_page_size constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-of-bounds writes during batch initialization.\n\nThe flaw was fixed in commit 94a286f by adding an overflow check:\n```Rust\nbatch_page_size\n    .checked_add(crate::nft_nlmsg_maxsize())\n    .expect(\"batch_page_size is too large and would overflow\");\n```","status":"published","published":"2025-11-25T23:18:37Z","modified":"2025-12-01T16:20:48.216069Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"RUSTSEC-2025-0126","title":"Heap-buffer-overflow in nftnl::Batch::with_page_size (nftnl-rs)","description":"A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::with_page_size constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-of-bounds writes during batch initialization.\n\nThe flaw was fixed in commit 94a286f by adding an overflow check:\n```Rust\nbatch_page_size\n    .checked_add(crate::nft_nlmsg_maxsize())\n    .expect(\"batch_page_size is too large and would overflow\");\n```\n\n## Mitigation\n\nUpgrade to version `0.9.0` or later, which aborts instead.","status":"published","published":"2025-10-18T12:00:00Z","modified":"2025-11-27T22:04:51.87566Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}