GHSA-3g4q-2f67-2gvhLow▾ Sunlitnetfoil has a resource leak in LRU cache
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up.
A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger service restarts when reached.
github.com/tinfoil-factory/netfoil < 0.3.0Upgrade to a patched release:
github.com/tinfoil-factory/netfoil 0.3.0Connected by shared product, vendor, weakness, or advisory.
GO-2026-5933Nonenetfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil
GO-2026-6277Nonenetfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil
GHSA-4ph6-mjv7-3fq6Lownetfoil vulnerable to improper handling of untrusted DoH response data
GO-2026-6143Nonenetfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil
GHSA-xvg2-cgv6-6h7vHighnetfoil: Incorrect block responses could lead to localhost traffic
GO-2026-5935Nonenetfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil