Netfoil doesn't decrement TTL
TTL was not decremented, so stale records would continue to be served.
Advisories for Golang/Github.com/Tinfoil-Factory/Netfoil package
2026
netfoil vulnerable to improper handling of untrusted DoH response data
HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data (which could contain arbitrary byte sequences) was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log.
netfoil: Incorrect block responses could lead to localhost traffic
0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped.
netfoil: Attacker controlled data written to logs
Domain names were written to the log without first being validated to contain allowed characters.
netfoil has a resource leak in LRU cache
When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up.
netfoil has a domain name filter bypass via multiple questions
Potential bypass of domain name filter by crafting a DNS request with multiple questions, with the first question being legitimate.
netfoil's optional seccomp sandboxing was not applied
The optional flag –filter-system-calls was not applied even if specified.
Netfoil has incorrect allowlist enforcement
Rules could be bypassed by changing the first character: example.com could be be bypassed by e.g. fxample.com.