GHSA-xvg2-cgv6-6h7v: netfoil: Incorrect block responses could lead to localhost traffic

July 29, 2026

0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped.

References

github.com/advisories/GHSA-xvg2-cgv6-6h7v
github.com/tinfoil-factory/netfoil/commit/891d3513c77999a9deef9f23506807d9653ee448
github.com/tinfoil-factory/netfoil/pull/33
github.com/tinfoil-factory/netfoil/releases/tag/v0.4.0
github.com/tinfoil-factory/netfoil/security/advisories/GHSA-xvg2-cgv6-6h7v

Code Behaviors & Features

Detect and mitigate GHSA-xvg2-cgv6-6h7v with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →