GHSA-xvg2-cgv6-6h7v netfoil: Incorrect block responses could lead to localhost traffic
Incorrect DNS block responses allow traffic to reach localhost instead of being dropped, bypassing intended blocking mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xvg2-cgv6-6h7v?
GHSA-xvg2-cgv6-6h7v is a vulnerability in github.com/tinfoil-factory/netfoil, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped.
Impact
Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules.
Which versions are affected by GHSA-xvg2-cgv6-6h7v?
3 open source packages ship an affected version, including github.com/tinfoil-factory/netfoil.
| Package | Affected | Fixed in |
|---|---|---|
github.com/tinfoil-factory/netfoil Go | All versions | 0.4.0 |
github.com/tinfoil-factory/netfoil Go | All versions | 0.4.0 |
github.com/tinfoil-factory/netfoil Go | All versions | 0.4.0 |
How do I fix GHSA-xvg2-cgv6-6h7v?
Upgrade github.com/tinfoil-factory/netfoil to 0.4.0 or later.
Is GHSA-xvg2-cgv6-6h7v being exploited?
There is no known exploitation of GHSA-xvg2-cgv6-6h7v in the wild and no public exploit code.
Sources
Also known as GO-2026-6143.