GHSA-3g4q-2f67-2gvh
netfoil has a resource leak in LRU cache
Summary
When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up.
Impact
A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger service restarts when reached.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score used
netfoil has a resource leak in LRU cache
Summary
When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up.
Impact
A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger service restarts when reached.
- Record
GHSA-3g4q-2f67-2gvh- CVSS 4.0
- 1.2 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-401
- Updated
- 2026-11-02
OSV
netfoil has a resource leak in LRU cache
Summary
When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up.
Impact
A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger service restarts when reached.
- Record
GHSA-3g4q-2f67-2gvh- CVSS 4.0
- 1.2 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVGO-2026-5933No score
netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil
netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil
- Record
GO-2026-5933- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/tinfoil-factory/netfoilGo | before 0.3.0 | 0.3.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-3g4q-2f67-2gvh is a low vulnerability (CVSS 1.2) in github.com/tinfoil-factory/netfoil, published July 7, 2026. No source lists public exploit code. Fixed in github.com/tinfoil-factory/netfoil 0.3.0.