Executive brief
netfoil is a Go-based library used for handling network traffic and DNS filtering. A security flaw allows a local attacker to bypass domain name filters by including multiple questions in a single DNS request. This could allow unauthorized access to restricted websites or services that the software was intended to block.
Technical details
A vulnerability exists in netfoil versions prior to 0.3.0 where the domain name filter can be bypassed due to an interpretation conflict (CWE-436). When a DNS request contains multiple questions, the filter may only validate the first (legitimate) question while allowing subsequent restricted domains to pass through to a remote DNS-over-HTTPS (DoH) server. This requires a local attacker to be able to craft multi-question DNS packets and for the upstream DoH server to support such requests. The issue is resolved in version 0.3.0.
Affected products
- tinfoil-factory netfoil < 0.3.0
Timeline
- 2026-05-31: disclosed
- 2026-07-07: advisory
- 0.3.0: patched