netfoil: Incorrect block responses could lead to localhost traffic
Netfoil versions prior to 0.4.0 use 0.0.0.0 instead of NXDOMAIN for block responses. On Linux systems, this causes blocked DNS queries to be redirected to localhost rather than being dropped. The impact depends on the services running on localhost and firewall configurations, potentially causing unintended local traffic.
AI Analysis
Technical Summary
Netfoil versions before 0.4.0 respond to blocked DNS queries with the IP address 0.0.0.0 instead of NXDOMAIN. On Linux, 0.0.0.0 is interpreted as localhost, causing blocked queries to be redirected to local services rather than being discarded. This behavior can lead to unintended traffic being sent to localhost, which may have security implications depending on the local environment and firewall rules. The vulnerability is categorized under CWE-693 and has a high severity rating based on the provided CVSS 4.0 vector.
Potential Impact
Blocked DNS queries intended to be dropped are instead redirected to localhost (127.0.0.1) on Linux systems. This could cause unintended local traffic, potentially exposing local services to unexpected requests or triggering unintended behavior. The actual impact depends on what services are running on localhost and the existing firewall rules. There are no known exploits in the wild at this time.
Mitigation Recommendations
No official patch or fix is currently documented. Users should check for updates beyond version 0.4.0 of netfoil, as versions prior to 0.4.0 are affected. Until a fix is available, users should consider network or firewall configurations to monitor or block unintended localhost traffic resulting from this behavior.
netfoil: Incorrect block responses could lead to localhost traffic
Description
Netfoil versions prior to 0.4.0 use 0.0.0.0 instead of NXDOMAIN for block responses. On Linux systems, this causes blocked DNS queries to be redirected to localhost rather than being dropped. The impact depends on the services running on localhost and firewall configurations, potentially causing unintended local traffic.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Netfoil versions before 0.4.0 respond to blocked DNS queries with the IP address 0.0.0.0 instead of NXDOMAIN. On Linux, 0.0.0.0 is interpreted as localhost, causing blocked queries to be redirected to local services rather than being discarded. This behavior can lead to unintended traffic being sent to localhost, which may have security implications depending on the local environment and firewall rules. The vulnerability is categorized under CWE-693 and has a high severity rating based on the provided CVSS 4.0 vector.
Potential Impact
Blocked DNS queries intended to be dropped are instead redirected to localhost (127.0.0.1) on Linux systems. This could cause unintended local traffic, potentially exposing local services to unexpected requests or triggering unintended behavior. The actual impact depends on what services are running on localhost and the existing firewall rules. There are no known exploits in the wild at this time.
Mitigation Recommendations
No official patch or fix is currently documented. Users should check for updates beyond version 0.4.0 of netfoil, as versions prior to 0.4.0 are affected. Until a fix is available, users should consider network or firewall configurations to monitor or block unintended localhost traffic resulting from this behavior.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xvg2-cgv6-6h7v
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["Go"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a6ae5499c2644c7f898851a
Added to database: 07/30/2026, 05:46:49 UTC
Last enriched: 07/30/2026, 07:18:46 UTC
Last updated: 07/31/2026, 12:28:13 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.