GHSA-4PH6-MJV7-3FQ6: Improper Handling of Untrusted DNS-over-HTTPS Response Data in netfoil
Vulnerability ID: GHSA-4PH6-MJV7-3FQ6
CVSS Score: 6.5
Published: 2026-08-24
netfoil, an allowlist-based DNS proxy, failed to sanitize ALPN fields parsed from untrusted DNS-over-HTTPS (DoH) HTTPS Resource Records. This allowed attackers to inject ANSI escape sequences into log files or trigger Denial of Service (DoS) via uncontrolled memory allocations.
TL;DR
Unvalidated ALPN parsing in netfoil permits terminal log injection and memory exhaustion.
Technical Details
- CWE ID: CWE-117, CWE-20, CWE-400
- Attack Vector: Network (DNS Response Control Required)
- CVSS v3.1 Score: 6.5
- Impact: Denial of Service, Log Manipulation
- Exploit Status: None
- KEV Status: Not Listed
Affected Systems
- netfoil DNS Proxy
-
netfoil: < v0.5.0 (Fixed in:
v0.5.0)
Code Analysis
Commit: 817f664
Only allow specific ALPN, ignore others
Commit: 58cfb0c
Format response code in log
Mitigation Strategies
- Strict static allowlist constraints on incoming ALPN identifiers
- Set-based deduplication map for memory bounds protection
- RCODE enumeration formatting to standard strings
Remediation Steps:
- Upgrade netfoil dependency to v0.5.0 or later
- Review log consumers for ANSI sequence ingestion vulnerabilities
- Enforce trusted upstream DNS-over-HTTPS resolvers
References
Read the full report for GHSA-4PH6-MJV7-3FQ6 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)