GHSA-84g5-x8j3-7235 Netfoil has incorrect allowlist enforcement
An off-by-one error in Netfoil's suffix trie allows attackers to bypass domain allowlists by modifying the first character of a URL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-84g5-x8j3-7235?
GHSA-84g5-x8j3-7235 is a vulnerability in github.com/tinfoil-factory/netfoil, published on 29 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
Rules could be bypassed by changing the first character: example.com could be be bypassed by e.g. fxample.com.
Details
Off-by-one error in the suffixtrie implementation.
Impact
The domain filter could be bypassed. Please note that DNS filtering alone is not enough to block malicious traffic.
Which versions are affected by GHSA-84g5-x8j3-7235?
3 open source packages ship an affected version, including github.com/tinfoil-factory/netfoil.
| Package | Affected | Fixed in |
|---|---|---|
github.com/tinfoil-factory/netfoil Go | All versions | 0.2.1 |
github.com/tinfoil-factory/netfoil Go | All versions | 0.2.1 |
github.com/tinfoil-factory/netfoil Go | All versions | 0.2.1 |
How do I fix GHSA-84g5-x8j3-7235?
Upgrade github.com/tinfoil-factory/netfoil to 0.2.1 or later.
Is GHSA-84g5-x8j3-7235 being exploited?
There is no known exploitation of GHSA-84g5-x8j3-7235 in the wild and no public exploit code.
Sources
Also known as GO-2026-5240.