GHSA-4ph6-mjv7-3fq6
netfoil vulnerable to improper handling of untrusted DoH response data
Summary
HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data (which could contain arbitrary byte sequences) was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score used
netfoil vulnerable to improper handling of untrusted DoH response data
Summary
HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data (which could contain arbitrary byte sequences) was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log.
- Record
GHSA-4ph6-mjv7-3fq6- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-117
- Updated
- 2026-11-02
OSV
netfoil vulnerable to improper handling of untrusted DoH response data
Summary
HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data (which could contain arbitrary byte sequences) was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log.
- Record
GHSA-4ph6-mjv7-3fq6- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-117
- Updated
- 2026-11-02
OSVGO-2026-6277No score
netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil
netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil
- Record
GO-2026-6277- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/tinfoil-factory/netfoilGo | before 0.5.0 | 0.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-4ph6-mjv7-3fq6 is a low vulnerability (CVSS 2.7) in github.com/tinfoil-factory/netfoil, published August 24, 2026. No source lists public exploit code. Fixed in github.com/tinfoil-factory/netfoil 0.5.0.
References
github.com/tinfoil-factory/netfoil/security/advisories/GHSA-4ph6-mjv7-3fq6