PT-2026-39430 · Go · Github.Com/Tinfoil-Factory/Netfoil

Published 2026-04-29 · Updated 2026-04-29

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

Rules could be bypassed by changing the first character: example.com could be be bypassed by e.g. fxample.com.

Details

Off-by-one error in the suffixtrie implementation.

Impact

The domain filter could be bypassed. Please note that DNS filtering alone is not enough to block malicious traffic.

Fix

Weakness Enumeration

CWE-193

CWE-183

Related Identifiers

GHSA-84G5-X8J3-7235

Affected Products

Github.Com/Tinfoil-Factory/Netfoil

References · 5

• https://osv.dev/vulnerability/GHSA-84g5-x8j3-7235 · Vendor Advisory
• https://github.com/tinfoil-factory/netfoil/commit/0ca054acf97b011e4fdd40392475c7786b975ec3 · Note
• https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-84g5-x8j3-7235 · Note
• https://github.com/tinfoil-factory/netfoil/releases/tag/v0.2.1 · Note
• https://github.com/tinfoil-factory/netfoil · Note