Executive brief
netfoil is a DNS-over-HTTPS client library used to securely resolve domain names. The library does not properly validate or sanitize data received from DoH servers before logging it, allowing malicious or malformed server responses to inject arbitrary content into log files or exhaust system memory. An attacker controlling or intercepting traffic to a DoH server could exploit this to corrupt application logs or trigger denial of service.
Technical details
The vulnerability exists in netfoil's DoH response handler, which processes HTTPS resource records (RR) and ALPN (Application-Layer Protocol Negotiation) data without proper validation or output encoding. Unverified ALPN byte sequences and single-byte response codes are written directly to logs (CWE-117: Improper Output Neutralization for Logs). The attack vector is network-based, requiring the attacker to respond to or intercept DoH queries; no authentication, privileges, or user interaction is needed. A malicious DoH server or MITM attacker can send crafted HTTPS RR data to inject special characters, newlines, or control bytes into application logs, potentially altering log interpretability. Additionally, malformed ALPN data can cause unnecessary memory allocation. The vulnerability was patched in version 0.5.0 by properly validating and filtering ALPN values and formatting the response code before logging.
Affected products
- tinfoil-factory netfoil < 0.5.0
Timeline
- 2026-06-12: disclosed: Advisory published by tinfoil-owner
- 2026-06-12: patched: Fix released in version 0.5.0
References
- https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-4ph6-mjv7-3fq6
- https://github.com/tinfoil-factory/netfoil/commit/58cfb0cb16b824e02bf53c2d67707e5e4bd9f59b
- https://github.com/tinfoil-factory/netfoil/commit/817f664c61aa64cbe0dbfcdfc05c16602b422e5b
- https://github.com/tinfoil-factory/netfoil/releases/tag/v0.5.0
- https://api.github.com/repos/tinfoil-factory/netfoil/security-advisories/GHSA-4ph6-mjv7-3fq6