tinfoil-factory netfoil protection mechanism failure in DNS block responses

Severity: high · CVSS 7.4 · Published 2026-07-29

netfoil, a DNS filtering tool, incorrectly handles blocked web addresses by directing traffic to the local computer instead of dropping it. On Linux systems, this could allow malicious actors to trick a user's device into sending sensitive data to internal services that were supposed to be private. The actual risk depends on what other software is running on the affected machine and how its firewall is configured.

Technologies: github.com/tinfoil-factory/netfoil (Go), Tinfoil Factory Netfoil. Vendors: Go, Tinfoil Factory.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.4, published 29 July 2026.
Which products and versions are affected?
github.com/tinfoil-factory/netfoil (Go) < 0.4.0; Tinfoil Factory Netfoil < 0.4.0.
Is there a fix for This vulnerability?
A patch was published on 2026-06-08: Version 0.4.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run github.com/tinfoil-factory/netfoil (Go) or Tinfoil Factory Netfoil at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A protection mechanism failure exists in netfoil's DNS proxy component where blocked domains are resolved to the IP address 0.0.0.0. On Linux, the target platform, the networking stack interprets 0.0.0.0 as the local interface (localhost) rather than an invalid or null route. An attacker could potentially leverage this to route traffic intended for a blocked external domain to sensitive local services. The vulnerability is rooted in the `dns_proxy.go` worker process and was addressed by switching the block response type to NXDOMAIN. This issue is fixed in version 0.4.0.

Affected products

  • tinfoil-factory netfoil < 0.4.0

Timeline

  • 2026-06-08: patched: Version 0.4.0 released
  • 2026-06-08: disclosed: Initial advisory publication by maintainer
  • 2026-07-29: advisory: GitHub Advisory Database review and publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.