Vulnerability GHSA-4ph6-mjv7-3fq6
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
2 months ago
August 24, 2026 at 08:43 PM UTC
netfoil vulnerable to improper handling of untrusted DoH response data
v0.1.0 - v0.4.0
v0.1.0 - v0.4.0
Summary
netfoil vulnerable to improper handling of untrusted DoH response data
Details
Summary
HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data (which could contain arbitrary byte sequences) was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
18 hours ago
Netfoil doesn't decrement TTL
v0.3.0 - v0.6.0 GHSA-9ppr-wfw9-xvr2
v0.3.0 - v0.6.0 GHSA-9ppr-wfw9-xvr2
Unknown
2 months ago
netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil
v0.1.0 - v0.4.0 GO-2026-6277
v0.1.0 - v0.4.0 GO-2026-6277
Unknown
2 months ago
netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil
v0.1.0 - v0.3.1 GO-2026-6143
v0.1.0 - v0.3.1 GO-2026-6143
High Risk
3 months ago
netfoil: Incorrect block responses could lead to localhost traffic
v0.1.0 - v0.3.1 GHSA-xvg2-cgv6-6h7v
v0.1.0 - v0.3.1 GHSA-xvg2-cgv6-6h7v
Unknown
3 months ago
netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil
v0.1.0 - v0.2.1 GO-2026-5933
v0.1.0 - v0.2.1 GO-2026-5933
Impacted packages
Timeline
Published
2 months ago
August 24, 2026 at 08:43 PM UTC
Fixed (v0.5.0)
4 months ago
June 12, 2026 at 06:26 PM UTC
Last Modified
2 months ago
August 26, 2026 at 01:21 AM UTC