RUSTSEC-2025-0126: Heap-buffer-overflow in nftnl::Batch::with_page_size (nftnl-rs)

What to do

1. See which version you have: cargo tree -i nftnl (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p nftnl. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example nftnl = "0.9.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::with_page_size constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-of-bounds writes during batch initialization.

The flaw was fixed in commit 94a286f by adding an overflow check:

batch_page_size
    .checked_add(crate::nft_nlmsg_maxsize())
    .expect("batch_page_size is too large and would overflow");

Mitigation

Upgrade to version 0.9.0 or later, which aborts instead.

References

• Package: crates.io/crates/nftnl
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0126.html
• Report: github.com/mullvad/nftnl-rs/issues/76#issue-3528876468

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.