Live › vulnerability › GHSA-9ppr-wfw9-xvr2
Netfoil, a Go DNS component, did not decrement the TTL of cached records. Stale records continued to be served after they should have expired.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:50 UTC. All times on this page are UTC.
Teams that import the netfoil Go module between 0.3.0 and 0.6.1 and rely on its cached records being refreshed. Services that do not use this module are not affected. The sources do not describe the deployment shape beyond that.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/tinfoil-factory/netfoil | go | >= 0.3.0, < 0.6.1 | 0.6.1 |
github.com/tinfoil-factory/netfoilgithub.com/tinfoil-factory/netfoil: move to 0.6.1 or later (affected , )>= 0.3.0< 0.6.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TTL was not decremented, so stale records would continue to be served.
This page as .md · .json · in your agent: get_signal("GHSA-9ppr-wfw9-xvr2")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.