---
title: "GHSA-2fjw-whxm-9v4q: libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)"
url: https://erroneo.us/security/ghsa/GHSA-2fjw-whxm-9v4q/
description: "GHSA-2fjw-whxm-9v4q (critical, crates.io (Rust)): libnftnl has Heap-based Buffer Overflow in nftnl::Batch::withpagesize (nftnl-rs). A heap-buffer-overflow…"
type: advisory
section: "Security Digest"
date_published: 2025-11-25
date_modified: 2025-12-01
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-2fjw-whxm-9v4q"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-2fjw-whxm-9v4q: libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)

## Affected packages

- crates.io (Rust) `nftnl` <= 0.8.0 → fixed: 0.9.0

## Details

A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::withpagesize constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-of-bounds writes during batch initialization. The flaw was fixed in commit 94a286f by adding an overflow check:

## Sources

- [GitHub Advisory GHSA-2fjw-whxm-9v4q](https://github.com/advisories/GHSA-2fjw-whxm-9v4q)
- [github.com](https://github.com/mullvad/nftnl-rs/issues/76#issue-3528876468)
- [github.com](https://github.com/mullvad/nftnl-rs/commit/94a286f87e88f431913d19668246de9006790125)
- [rustsec.org](https://rustsec.org/advisories/RUSTSEC-2025-0126.html)

---
Source page: https://erroneo.us/security/ghsa/GHSA-2fjw-whxm-9v4q/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt