netfoil: Incorrect block responses could lead to localhost traffic
0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped.
Advisories for Golang/Github.com/Tinfoil-Factory/Netfoil package
2026
netfoil: Attacker controlled data written to logs
Domain names were written to the log without first being validated to contain allowed characters.
netfoil has a resource leak in LRU cache
When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up.
netfoil has a domain name filter bypass via multiple questions
Potential bypass of domain name filter by crafting a DNS request with multiple questions, with the first question being legitimate.
netfoil's optional seccomp sandboxing was not applied
The optional flag –filter-system-calls was not applied even if specified.
Netfoil has incorrect allowlist enforcement
Rules could be bypassed by changing the first character: example.com could be be bypassed by e.g. fxample.com.