tinfoil-factory netfoil resource leak in LRU cache

Executive brief

A memory leak exists in the netfoil library's caching mechanism. A local attacker can exploit this to force the application to consume excessive memory, potentially leading to service restarts and temporary unavailability if memory limits are reached.

Technical details

A memory leak (CWE-401) exists in the netfoil LRU cache implementation. When an entry is removed from the cache, a pointer to the removed element is not properly cleaned up, preventing the memory from being reclaimed. A local attacker can trigger this leak to increase the process's memory footprint. In environments using systemd with default memory limits (e.g., 100MB), this will eventually trigger an Out-Of-Memory (OOM) kill or service restart, resulting in a local denial-of-service. The issue is fixed in version 0.3.0.

Affected products

• tinfoil-factory netfoil < 0.3.0

Timeline

• 2026-05-31: disclosed: Initial disclosure by tinfoil-owner
• 2026-07-07: advisory: GitHub Advisory published
• 2026-07-07: patched: Fix available in version 0.3.0

References

• https://api.github.com/users/stigtsp
• https://github.com/stigtsp
• https://api.github.com/users/stigtsp/gists%7B/gist_id%7D
• https://api.github.com/users/stigtsp/repos
• https://avatars.githubusercontent.com/u/75371?v=4
• https://api.github.com/users/stigtsp/events%7B/privacy%7D