Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

mnl

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.0crates.ioPublished

    mnl has segmentation fault and invalid memory read in mnl::cb_run

    GHSA-585q-cm62-757j

    Affected
    • crates.io mnl <= 0.3.0
    Fixed in
    0.3.1· Vendor fix available
    Issue
    The function mnl::cbrun is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers. Passing a crafted byte slice to mnl::cbrun can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads. This vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.

    Recommended action: Upgrade to 0.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →