What is GHSA-xvg2-cgv6-6h7v?

GHSA-xvg2-cgv6-6h7v is a security advisory published by GitHub Security Advisories with High severity. netfoil: Incorrect block responses could lead to localhost traffic

Why does GHSA-xvg2-cgv6-6h7v have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-xvg2-cgv6-6h7v?

GHSA-xvg2-cgv6-6h7v affects 1 product, including: go/github.com/tinfoil-factory/netfoil:\u003c 0.4.0.

GHSA-xvg2-cgv6-6h7vHighDisclosed before NVD

netfoil: Incorrect block responses could lead to localhost traffic

Vendor

GitHub Security Advisories

Published

July 29, 2026

Last Modified

July 29, 2026

📋 Description

Summary

0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped.

Impact

Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules.

🎯 Affected products1

go/github.com/tinfoil-factory/netfoil:< 0.4.0

🔗 References (5)

https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-xvg2-cgv6-6h7v
https://github.com/tinfoil-factory/netfoil/pull/33
https://github.com/tinfoil-factory/netfoil/commit/891d3513c77999a9deef9f23506807d9653ee448
https://github.com/tinfoil-factory/netfoil/releases/tag/v0.4.0
https://github.com/advisories/GHSA-xvg2-cgv6-6h7v