{"id":"GHSA-3g4q-2f67-2gvh","title":"netfoil has a resource leak in LRU cache","summary":"netfoil has a resource leak in LRU cache","severity":"low","cwe":["CWE-401"],"vendor":"tinfoil-factory","product":"github.com/tinfoil-factory/netfoil","ecosystem":"go","affected":["github.com/tinfoil-factory/netfoil < 0.3.0"],"patched":["github.com/tinfoil-factory/netfoil 0.3.0"],"published":"2026-07-07","updated":"2026-07-07","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-3g4q-2f67-2gvh","references":[{"url":"https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-3g4q-2f67-2gvh"},{"url":"https://github.com/advisories/GHSA-3g4q-2f67-2gvh"}],"tags":["ghsa","go"],"ingestedAt":"2026-07-07T20:43:04.990Z","slug":"GHSA-3g4q-2f67-2gvh","body":"## Overview\n\n### Summary\nWhen an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up.\n\n### Impact\nA local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger service restarts when reached.\n\n## Affected packages\n\n- `github.com/tinfoil-factory/netfoil < 0.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/tinfoil-factory/netfoil 0.3.0`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}