{"id":"GHSA-2fjw-whxm-9v4q","aliases":["RUSTSEC-2025-0126"],"url":"https://o3.security/vulnerability/GHSA-2fjw-whxm-9v4q","summary":"libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)","details":"A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::with_page_size constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-of-bounds writes during batch initialization.\n\nThe flaw was fixed in commit 94a286f by adding an overflow check:\n```Rust\nbatch_page_size\n    .checked_add(crate::nft_nlmsg_maxsize())\n    .expect(\"batch_page_size is too large and would overflow\");\n```","published":"2025-11-25T23:18:37Z","modified":"2025-12-01T16:20:48.216069Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"nftnl","fixedVersion":"0.9.0"}],"fix":{"url":"https://github.com/mullvad/nftnl-rs/commit/94a286f87e88f431913d19668246de9006790125","label":"mullvad/nftnl-rs@94a286f"},"references":[{"type":"WEB","url":"https://github.com/mullvad/nftnl-rs/issues/76#issue-3528876468"},{"type":"WEB","url":"https://github.com/mullvad/nftnl-rs/commit/94a286f87e88f431913d19668246de9006790125"},{"type":"PACKAGE","url":"https://github.com/mullvad/nftnl-rs"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2025-0126.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-12-01T16:20:48.216069Z"}}