{"id":"GHSA-xvg2-cgv6-6h7v","aliases":["GO-2026-6143"],"status":"published","title":"netfoil: Incorrect block responses could lead to localhost traffic","description":"### Summary\n`0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the `0.0.0.0` is sent to localhost rather than just dropped.\n\n### Impact\nUnintended traffic could be sent to localhost. Impact depends on running services and firewall rules.","severity":{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2026-07-29T17:03:48Z","modified":"2026-08-18T15:11:06Z","fixes":[{"ecosystem":"Go","package":"github.com/tinfoil-factory/netfoil","fixed_in":["0.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/tinfoil-factory/netfoil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/tinfoil-factory/netfoil","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/tinfoil-factory/netfoil","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]}],"references":[{"url":"https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-xvg2-cgv6-6h7v","tags":["web","advisory"]},{"url":"https://github.com/tinfoil-factory/netfoil/pull/33","tags":["web","fix"]},{"url":"https://github.com/tinfoil-factory/netfoil/commit/891d3513c77999a9deef9f23506807d9653ee448","tags":["web","fix"]},{"url":"https://github.com/tinfoil-factory/netfoil/releases/tag/v0.4.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xvg2-cgv6-6h7v"},{"url":"https://github.com/tinfoil-factory/netfoil","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-xvg2-cgv6-6h7v","title":"netfoil: Incorrect block responses could lead to localhost traffic","description":"### Summary\n`0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the `0.0.0.0` is sent to localhost rather than just dropped.\n\n### Impact\nUnintended traffic could be sent to localhost. Impact depends on running services and firewall rules.","status":"published","published":"2026-07-29T17:03:48Z","modified":"2026-07-29T17:03:48Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"osv":[{"id":"GHSA-xvg2-cgv6-6h7v","title":"netfoil: Incorrect block responses could lead to localhost traffic","description":"### Summary\n`0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the `0.0.0.0` is sent to localhost rather than just dropped.\n\n### Impact\nUnintended traffic could be sent to localhost. Impact depends on running services and firewall rules.","status":"published","published":"2026-07-29T17:03:48Z","modified":"2026-08-18T15:11:06.019886818Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"GO-2026-6143","title":"netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil","description":"netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil","status":"published","published":"2026-08-18T14:32:29Z","modified":"2026-08-18T15:00:22.73445781Z","updated_at":"2026-11-02T15:47:02.838915Z"}]}}