{"id":"GHSA-xvg2-cgv6-6h7v","title":"netfoil: Incorrect block responses could lead to localhost traffic","summary":"netfoil: Incorrect block responses could lead to localhost traffic","severity":"high","cwe":["CWE-693"],"vendor":"tinfoil-factory","product":"github.com/tinfoil-factory/netfoil","ecosystem":"go","affected":["github.com/tinfoil-factory/netfoil < 0.4.0"],"patched":["github.com/tinfoil-factory/netfoil 0.4.0"],"published":"2026-07-29","updated":"2026-07-29","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-xvg2-cgv6-6h7v","references":[{"url":"https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-xvg2-cgv6-6h7v"},{"url":"https://github.com/tinfoil-factory/netfoil/pull/33"},{"url":"https://github.com/tinfoil-factory/netfoil/commit/891d3513c77999a9deef9f23506807d9653ee448"},{"url":"https://github.com/tinfoil-factory/netfoil/releases/tag/v0.4.0"},{"url":"https://github.com/advisories/GHSA-xvg2-cgv6-6h7v"}],"tags":["ghsa","go"],"ingestedAt":"2026-07-29T17:48:50.094Z","slug":"GHSA-xvg2-cgv6-6h7v","body":"## Overview\n\n### Summary\n`0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the `0.0.0.0` is sent to localhost rather than just dropped.\n\n### Impact\nUnintended traffic could be sent to localhost. Impact depends on running services and firewall rules.\n\n## Affected packages\n\n- `github.com/tinfoil-factory/netfoil < 0.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/tinfoil-factory/netfoil 0.4.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}