GHSA-xvg2-cgv6-6h7v
netfoil: Incorrect block responses could lead to localhost traffic
GHSA-xvg2-cgv6-6h7v is a high vulnerability (CVSS 7.4) in github.com/tinfoil-factory/netfoil, published July 29, 2026. No source lists public exploit code. Fixed in github.com/tinfoil-factory/netfoil 0.4.0.
- Severity
- 7.4 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.4.0github.com/tinfoil-factory/netfoil
Description
Summary
0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped.
Impact
Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/tinfoil-factory/netfoilGo | before 0.4.0 | 0.4.0 |
What each source reports
GitHub Advisories Score used
netfoil: Incorrect block responses could lead to localhost traffic
Summary
0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped.
Impact
Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules.
- Record
GHSA-xvg2-cgv6-6h7v- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-693
- Updated
- 2026-11-02
OSV
netfoil: Incorrect block responses could lead to localhost traffic
Summary
0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped.
Impact
Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules.
- Record
GHSA-xvg2-cgv6-6h7v- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-693
- Updated
- 2026-11-02
OSVGO-2026-6143No score
netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil
netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil
- Record
GO-2026-6143- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/tinfoil-factory/netfoil/security/advisories/GHSA-xvg2-cgv6-6h7v