Loading...
Skip to main content
GeekWala

GHSA-2fjw-whxm-9v4q — libnftnl has Heap-based Buffer Overflow in...

CRITICAL

libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)

Published November 25, 2025Updated December 1, 2025Source: osv

Summary

A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::with_page_size constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-of-bounds writes during batch initialization. The flaw was fixed in commit 94a286f by adding an overflow check: ```Rust batch_page_size .checked_add(crate::nft_nlmsg_maxsize()) .expect("batch_page_size is too large and would overflow"); ```

Advisory Timeline

  • First published November 25, 2025 (320 days ago).
  • Last revised December 1, 2025 — 6 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update nftnl to 0.9.0 or later
cargo update -p nftnl --precise 0.9.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: crates.io (1).

PackageEcosystemAffectedFixed In
nftnl
crates.io
All versions0.9.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 10.0 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N

References

Frequently Asked Questions

What is GHSA-2fjw-whxm-9v4q?
libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs) This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 10.0/10).
How do I check if my project is affected by GHSA-2fjw-whxm-9v4q?
GHSA-2fjw-whxm-9v4q affects nftnl. Use GeekWala's free vulnerability scanner to check your dependencies against GHSA-2fjw-whxm-9v4q and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
10.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

RUSTSEC-2025-0126

Related CVEs

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies