Vulnerability GHSA-xvg2-cgv6-6h7v
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 months ago
July 29, 2026 at 05:03 PM UTC
netfoil: Incorrect block responses could lead to localhost traffic
v0.1.0 - v0.3.1
v0.1.0 - v0.3.1
Summary
netfoil: Incorrect block responses could lead to localhost traffic
Details
Summary
0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped.
Impact
Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
18 hours ago
Netfoil doesn't decrement TTL
v0.3.0 - v0.6.0 GHSA-9ppr-wfw9-xvr2
v0.3.0 - v0.6.0 GHSA-9ppr-wfw9-xvr2
Unknown
2 months ago
netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil
v0.1.0 - v0.4.0 GO-2026-6277
v0.1.0 - v0.4.0 GO-2026-6277
Low Risk
2 months ago
netfoil vulnerable to improper handling of untrusted DoH response data
v0.1.0 - v0.4.0 GHSA-4ph6-mjv7-3fq6
v0.1.0 - v0.4.0 GHSA-4ph6-mjv7-3fq6
Unknown
2 months ago
netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil
v0.1.0 - v0.3.1 GO-2026-6143
v0.1.0 - v0.3.1 GO-2026-6143
Unknown
3 months ago
netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil
v0.1.0 - v0.2.1 GO-2026-5933
v0.1.0 - v0.2.1 GO-2026-5933
Impacted packages
Timeline
Published
3 months ago
July 29, 2026 at 05:03 PM UTC
Fixed (v0.4.0)
4 months ago
June 08, 2026 at 08:01 PM UTC
Last Modified
2 months ago
August 18, 2026 at 03:11 PM UTC