GHSA-2fjw-whxm-9v4q Heap-buffer-overflow in nftnl::Batch::with_page_size (nftnl-rs)

Not scored Published 18 Oct 2025

A heap-buffer-overflow in the nftnl-rs library allows attackers to cause out-of-bounds writes and potential code execution via malformed page sizes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Not stated
Victim action needed: Not needed
Fix: Available

What is GHSA-2fjw-whxm-9v4q?

GHSA-2fjw-whxm-9v4q is a memory corruption vulnerability in nftnl, published on 18 Oct 2025.

Official description

A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::with_page_size constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-of-bounds writes during batch initialization.

The flaw was fixed in commit 94a286f by adding an overflow check:

batch_page_size
    .checked_add(crate::nft_nlmsg_maxsize())
    .expect(&#34;batch_page_size is too large and would overflow&#34;);

Mitigation

Upgrade to version 0.9.0 or later, which aborts instead.

Which versions are affected by GHSA-2fjw-whxm-9v4q?

3 open source packages ship an affected version, including nftnl.

Package	Affected	Fixed in
`nftnl` crates.io	All versions	`0.9.0`
`nftnl` crates.io	All versions	`0.9.0`
`nftnl` crates.io	From `0.0.0-0`	`0.9.0`

How do I fix GHSA-2fjw-whxm-9v4q?

Upgrade nftnl to 0.9.0 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is GHSA-2fjw-whxm-9v4q being exploited?

There is no known exploitation of GHSA-2fjw-whxm-9v4q in the wild and no public exploit code.

Sources

Also known as RUSTSEC-2025-0126.