GO-2026-6277 netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil

netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil...

PT-2026-82027

netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil...

netfoil vulnerable to improper handling of untrusted DoH response data

Summary HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data which could contain arbitrary byte sequences was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log...

GHSA-4PH6-MJV7-3FQ6 netfoil vulnerable to improper handling of untrusted DoH response data

Summary HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data which could contain arbitrary byte sequences was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log...

GO-2026-6143 netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil

netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil...

PT-2026-80387

netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure due to the use of 0.0.0.0 instead of NXDOMAIN in block responses. An attacker can cause unintended network traffic to be sent to localhost by triggering blocked DNS queries. Remediation Upgrade...

PT-2026-69244

Summary 0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped. Impact Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules...

GO-2026-5933 netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil

netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil...

GO-2026-5935 netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil

netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil...

GO-2026-5934 netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil

netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil...

Improper Output Neutralization for Logs

Overview Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the readDomain parser in dns/dns.go. An attacker can write attacker-controlled domain labels into logs by supplying a DNS name containing disallowed characters, because the parser accepted eac...

GHSA-3G4Q-2F67-2GVH netfoil has a resource leak in LRU cache

Summary When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up. Impact A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger service restarts when reached...

PT-2026-60905

Summary When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up. Impact A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger service restarts when reached...

GO-2026-5664 netfoil's optional seccomp sandboxing was not applied in github.com/tinfoil-factory/netfoil

netfoil's optional seccomp sandboxing was not applied in github.com/tinfoil-factory/netfoil...

GO-2026-5240 Netfoil has incorrect allowlist enforcement in github.com/tinfoil-factory/netfoil

Netfoil has incorrect allowlist enforcement in github.com/tinfoil-factory/netfoil...

GHSA-VJGJ-42F6-7997 netfoil's optional seccomp sandboxing was not applied

Summary The optional flag --filter-system-calls was not applied even if specified. Details This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd. Impact Reduced sandboxing of the netfoil binar...

netfoil's optional seccomp sandboxing was not applied

Summary The optional flag --filter-system-calls was not applied even if specified. Details This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd. Impact Reduced sandboxing of the netfoil binar...

GHSA-84G5-X8J3-7235 Netfoil has incorrect allowlist enforcement

Summary Rules could be bypassed by changing the first character: example.com could be be bypassed by e.g. fxample.com. Details Off-by-one error in the suffixtrie implementation. Impact The domain filter could be bypassed. Please note that DNS filtering alone is not enough to block malicious traff...

PT-2026-39434

Summary The optional flag --filter-system-calls was not applied even if specified. Details This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd. Impact Reduced sandboxing of the netfoil binar...