---
id: GHSA-3g4q-2f67-2gvh
title: netfoil has a resource leak in LRU cache
summary: netfoil has a resource leak in LRU cache
severity: low
cwe:
  - CWE-401
vendor: tinfoil-factory
product: github.com/tinfoil-factory/netfoil
ecosystem: go
affected:
  - github.com/tinfoil-factory/netfoil < 0.3.0
patched:
  - github.com/tinfoil-factory/netfoil 0.3.0
published: '2026-07-07'
updated: '2026-07-07'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-3g4q-2f67-2gvh'
references:
  - url: >-
      https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-3g4q-2f67-2gvh
  - url: 'https://github.com/advisories/GHSA-3g4q-2f67-2gvh'
tags:
  - ghsa
  - go
ingestedAt: '2026-07-07T20:43:04.990Z'
---

## Overview

### Summary
When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up.

### Impact
A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger service restarts when reached.

## Affected packages

- `github.com/tinfoil-factory/netfoil < 0.3.0`

## Remediation

Upgrade to a patched release:

- `github.com/tinfoil-factory/netfoil 0.3.0`