GitHub Advisoryadvisory · Go

GHSA-59qp-cfj3-rp64 netfoil has a domain name filter bypass via multiple questions

MEDIUM Published 2026-07-07 Modified 2026-07-07 Official page ↗
Ecosystem
Go
Packages
github.com/tinfoil-factory/netfoil
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-436, CWE-693
Reviewed
2026-07-07

Affected packages

• Go github.com/tinfoil-factory/netfoil: < 0.3.0 → fixed in 0.3.0

Description

Summary Potential bypass of domain name filter by crafting a DNS request with multiple questions, with the first question being legitimate. Impact Depends on a local attackers ability to craft multiple questions and the remote DoH server supporting them.

Related

Weakness · CWE (2)

  • CWE-436 Interpretation Conflict weakness
  • CWE-693 Protection Mechanism Failure weakness

References