{"vulnerability": "ghsa-4ph6-mjv7-3fq6", "sightings": [{"uuid": "7da9f63c-bfeb-4ebe-b7d7-2cc000bb09b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-4PH6-MJV7-3FQ6", "type": "seen", "source": "https://gist.github.com/alon710/420bec7ea2d482fe6de8ec25ca5555ea", "content": "# GHSA-4PH6-MJV7-3FQ6: GHSA-4PH6-MJV7-3FQ6: Improper Handling of Untrusted DNS-over-HTTPS Response Data in netfoil\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-24\n> **Full Report:** https://cvereports.com/reports/GHSA-4PH6-MJV7-3FQ6\n\n## Summary\nnetfoil, an allowlist-based DNS proxy, failed to sanitize ALPN fields parsed from untrusted DNS-over-HTTPS (DoH) HTTPS Resource Records. This allowed attackers to inject ANSI escape sequences into log files or trigger Denial of Service (DoS) via uncontrolled memory allocations.\n\n## TL;DR\nUnvalidated ALPN parsing in netfoil permits terminal log injection and memory exhaustion.\n\n## Technical Details\n\n- **CWE ID**: CWE-117, CWE-20, CWE-400\n- **Attack Vector**: Network (DNS Response Control Required)\n- **CVSS v3.1 Score**: 6.5\n- **Impact**: Denial of Service, Log Manipulation\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- netfoil DNS Proxy\n- **netfoil**: < v0.5.0 (Fixed in: `v0.5.0`)\n\n## Mitigation\n\n- Strict static allowlist constraints on incoming ALPN identifiers\n- Set-based deduplication map for memory bounds protection\n- RCODE enumeration formatting to standard strings\n\n**Remediation Steps:**\n1. Upgrade netfoil dependency to v0.5.0 or later\n2. Review log consumers for ANSI sequence ingestion vulnerabilities\n3. Enforce trusted upstream DNS-over-HTTPS resolvers\n\n## References\n\n- [GHSA-4PH6-MJV7-3FQ6 Advisory Page](https://github.com/advisories/GHSA-4PH6-MJV7-3FQ6)\n- [netfoil Source Code Repository](https://github.com/tinfoil-factory/netfoil)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-4PH6-MJV7-3FQ6) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-24T21:31:53.399618Z"}]}