{"id":"GHSA-xvg2-cgv6-6h7v","summary":"netfoil: Incorrect block responses could lead to localhost traffic","details":"### Summary\n`0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the `0.0.0.0` is sent to localhost rather than just dropped.\n\n### Impact\nUnintended traffic could be sent to localhost. Impact depends on running services and firewall rules.","aliases":["GO-2026-6143"],"modified":"2026-08-18T15:11:06.019886818Z","published":"2026-07-29T17:03:48Z","database_specific":{"github_reviewed_at":"2026-07-29T17:03:48Z","nvd_published_at":null,"cwe_ids":["CWE-693"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-xvg2-cgv6-6h7v"},{"type":"WEB","url":"https://github.com/tinfoil-factory/netfoil/pull/33"},{"type":"WEB","url":"https://github.com/tinfoil-factory/netfoil/commit/891d3513c77999a9deef9f23506807d9653ee448"},{"type":"PACKAGE","url":"https://github.com/tinfoil-factory/netfoil"},{"type":"WEB","url":"https://github.com/tinfoil-factory/netfoil/releases/tag/v0.4.0"}],"affected":[{"package":{"name":"github.com/tinfoil-factory/netfoil","ecosystem":"Go","purl":"pkg:golang/github.com/tinfoil-factory/netfoil"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-xvg2-cgv6-6h7v/GHSA-xvg2-cgv6-6h7v.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}