netfoil improper output neutralization for logs in DoH response handling

Severity: low · CVSS 2.7 · Published 2026-08-24

netfoil is a DNS-over-HTTPS client library used to securely resolve domain names. The library does not properly validate or sanitize data received from DoH servers before logging it, allowing malicious or malformed server responses to inject arbitrary content into log files or exhaust system memory. An attacker controlling or intercepting traffic to a DoH server could exploit this to corrupt application logs or trigger denial of service.

Technologies: github.com/tinfoil-factory/netfoil (Go), Tinfoil Factory Netfoil. Vendors: Go, Tinfoil Factory.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 2.7, published 24 August 2026.
Which products and versions are affected?
github.com/tinfoil-factory/netfoil (Go) < 0.5.0; Tinfoil Factory Netfoil < 0.5.0.
Is there a fix for This vulnerability?
A patch was published on 2026-06-12: Fix released in version 0.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run github.com/tinfoil-factory/netfoil (Go) or Tinfoil Factory Netfoil at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in netfoil's DoH response handler, which processes HTTPS resource records (RR) and ALPN (Application-Layer Protocol Negotiation) data without proper validation or output encoding. Unverified ALPN byte sequences and single-byte response codes are written directly to logs (CWE-117: Improper Output Neutralization for Logs). The attack vector is network-based, requiring the attacker to respond to or intercept DoH queries; no authentication, privileges, or user interaction is needed. A malicious DoH server or MITM attacker can send crafted HTTPS RR data to inject special characters, newlines, or control bytes into application logs, potentially altering log interpretability. Additionally, malformed ALPN data can cause unnecessary memory allocation. The vulnerability was patched in version 0.5.0 by properly validating and filtering ALPN values and formatting the response code before logging.

Affected products

  • tinfoil-factory netfoil < 0.5.0

Timeline

  • 2026-06-12: disclosed: Advisory published by tinfoil-owner
  • 2026-06-12: patched: Fix released in version 0.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.