GitHub Advisoryadvisory · Go

GHSA-84g5-x8j3-7235 Netfoil has incorrect allowlist enforcement

MEDIUM Published 2026-04-29 Modified 2026-04-29 Official page ↗
Ecosystem
Go
Packages
github.com/tinfoil-factory/netfoil
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-183, CWE-193
Reviewed
2026-04-29

Affected packages

• Go github.com/tinfoil-factory/netfoil: < 0.2.1 → fixed in 0.2.1

Description

Summary Rules could be bypassed by changing the first character: `example.com` could be be bypassed by e.g. `fxample.com`. Details Off-by-one error in the suffixtrie implementation. Impact The domain filter could be bypassed. Please note that DNS filtering alone is not enough to block malicious traffic.

Related

Weakness · CWE (2)

  • CWE-183 Permissive List of Allowed Inputs weakness
  • CWE-193 Off-by-one Error weakness

References