{"id":"GHSA-9ppr-wfw9-xvr2","kind":"vulnerability","aliases":["GHSA-9ppr-wfw9-xvr2"],"related":[],"title":"Netfoil doesn't decrement TTL","description":"### Summary\nTTL was not decremented, so stale records would continue to be served.","summary":"Netfoil, a Go DNS component, did not decrement the TTL of cached records. Stale records continued to be served after they should have expired.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/tinfoil-factory/netfoil","fixed":["0.6.1"],"affected":">= 0.3.0, < 0.6.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-672","dns","go","netfoil","package"],"not_affected_if":["module-version-outside-range"],"how_to_check":"- Check the Go module version in go.mod for `github.com/tinfoil-factory/netfoil`","fix":"- Go module `github.com/tinfoil-factory/netfoil`: move to `0.6.1` or later (affected `>= 0.3.0`, `< 0.6.1`)","status":"open","published_at":"2026-11-03T16:48:29+00:00","first_seen_at":"2026-11-03T16:50:48+00:00","triaged_at":"2026-11-03T16:52:37+00:00","updated_at":"2026-11-03T16:52:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T16:52:37Z","model":"claude-haiku-5-5","output":{"fix":"- Go module `github.com/tinfoil-factory/netfoil`: move to `0.6.1` or later (affected `>= 0.3.0`, `< 0.6.1`)","reach":"unknown","title":"Netfoil: TTL not decremented, so stale DNS records keep being served","impact":"low","summary":"Netfoil, a Go DNS component, did not decrement the TTL of cached records. Stale records continued to be served after they should have expired.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","netfoil","dns"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"stale DNS records served past their intended expiry","analyst_note":"","how_to_check":"- Check the Go module version in go.mod for `github.com/tinfoil-factory/netfoil`\n- Unknown whether other checks apply; the sources do not say","plain_action":"","needs_analyst":false,"not_affected_if":["module-version-outside-range"],"who_is_affected":"Teams that import the netfoil Go module between 0.3.0 and 0.6.1 and rely on its cached records being refreshed. Services that do not use this module are not affected. The sources do not describe the deployment shape beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000652,"input_tokens":4168,"output_tokens":471,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-672':20B '/tinfoil-factory/netfoil':18A '9ppr':8A,13A 'cach':36B 'compon':29B 'continu':40B,58C 'cwe':19B 'decrement':4A,32B,53C 'dns':21B,28B 'doesn':2A 'expir':48B 'ghsa':7A,12A 'ghsa-9ppr-wfw9-xvr2':6A,11A 'github.com':17A 'github.com/tinfoil-factory/netfoil':16A 'go':22B,27B 'netfoil':1A,23B,25B 'packag':24B 'record':37B,39B,56C 'serv':43B,61C 'stale':38B,55C 'summari':49C 'ttl':5A,34B,50C 'wfw9':9A,14A 'would':57C 'xvr2':10A,15A","nicknames":[],"mitigations":[],"who_affected":"Teams that import the netfoil Go module between 0.3.0 and 0.6.1 and rely on its cached records being refreshed. Services that do not use this module are not affected. The sources do not describe the deployment shape beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["githubcomtinfoilfactorynetfoil"],"ptokens":["com","factory","github","netfoil","tinfoil"],"labels":["cwe672","dns","go","medium","netfoil","package"],"first_public_at":"2026-11-03T16:48:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9ppr-wfw9-xvr2","url":"https://github.com/advisories/GHSA-9ppr-wfw9-xvr2","severity":"medium","published_at":"2026-11-03T16:48:29+00:00","modified_at":"2026-11-03T16:48:30+00:00","first_seen_at":"2026-11-03T16:50:48+00:00","fetched_at":"2026-11-03T17:00:56+00:00","note":null}],"documents":[{"id":58940,"url":"https://api.github.com/repos/tinfoil-factory/netfoil/security-advisories/GHSA-9ppr-wfw9-xvr2","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":58941,"url":"https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-9ppr-wfw9-xvr2","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":58942,"url":"https://github.com/tinfoil-factory/netfoil/pull/44","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58943,"url":"https://github.com/tinfoil-factory/netfoil/commit/ea42977900c864b7b1c42f26c5870c86008118a0","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58944,"url":"https://github.com/tinfoil-factory/netfoil/releases/tag/v0.6.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}