GHSA-9ppr-wfw9-xvr2: DNS Cache TTL Manipulation Failure in Netfoil via Go Value-Copy Range Iteration

Vulnerability ID: GHSA-9PPR-WFW9-XVR2
CVSS Score: 5.3
Published: 2026-11-03

A logic flaw in github.com/tinfoil-factory/netfoil versions 0.3.0 through 0.6.0 prevents the DNS proxy from properly decrementing Time-To-Live (TTL) values on cached DNS responses and enforcing configured maximum TTL limits. Due to an idiomatic Go programming mistake where a range loop modifies value copies of slice elements rather than the underlying slice array, netfoil continually serves DNS answers with their original static TTLs. This condition causes downstream clients and resolvers to retain stale DNS records beyond their intended expiration window and bypasses local MaxTTL administrative policies.

TL;DR

Netfoil versions >= 0.3.0 and < 0.6.1 fail to decrement DNS response TTLs and fail to enforce MaxTTL bounds because range loops in internal/dns/dns_proxy.go mutate local struct copies rather than backing slice elements. Upgrade to version v0.6.1 to remediate the flaw.

Technical Details

• Vulnerability ID: GHSA-9ppr-wfw9-xvr2 (No CVE Assigned)
• Affected Package: github.com/tinfoil-factory/netfoil (Go)
• Affected Versions: >= 0.3.0, < 0.6.1 (Fixed in v0.6.1)
• Root Cause CWE: CWE-563 (Assignment to Variable without Use) / CWE-684
• CVSS v3.1 Score: 5.3 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
• Technical Impact: Stale DNS cache retention & MaxTTL policy bypass
• Exploit Status: None (No public PoC or active exploitation)

Affected Systems

• github.com/tinfoil-factory/netfoil
• github.com/tinfoil-factory/netfoil: >= 0.3.0, < 0.6.1 (Fixed in: 0.6.1)

Code Analysis

Commit: ea42977

Fix TTL

diff --git a/internal/dns/dns_proxy.go b/internal/dns/dns_proxy.go
index 7b14f16..0ed3a1d 100644
--- a/internal/dns/dns_proxy.go
+++ b/internal/dns/dns_proxy.go
@@ -76,12 +76,12 @@ func (t *timedResponse) rewriteTTLs() (result *Response, stillValid bool) {
        Answers:   slices.Clone(t.response.Answers),
    }

-   for _, a := range result.Answers {
-       if a.TTL >= diffSeconds {
-           a.TTL = a.TTL - diffSeconds
+   for i := range result.Answers {
+       if result.Answers[i].TTL >= diffSeconds {
+           result.Answers[i].TTL = result.Answers[i].TTL - diffSeconds
        } else {
            ok = false
-           a.TTL = 0
+           result.Answers[i].TTL = 0
        }
    }

@@ -618,9 +618,9 @@ func (w *worker) process(workerTask *workerTask) (processResponse, error) {
                // TODO responses without at TTL will not be evicted from the cache, so not caching it for now
                // TODO decide what to do with large responses
                if len(candidateResponse.Answers) > 0 && len(candidateResponse.Answers) < 1000 {
-                   for _, answer := range candidateResponse.Answers {
-                       if answer.TTL > w.config.MaxTTL {
-                           answer.TTL = w.config.MaxTTL
+                   for i := range candidateResponse.Answers {
+                       if candidateResponse.Answers[i].TTL > w.config.MaxTTL {
+                           candidateResponse.Answers[i].TTL = w.config.MaxTTL
                        }
                    }

Mitigation Strategies

• Upgrade github.com/tinfoil-factory/netfoil to version v0.6.1 or later.
• Flush or restart the netfoil proxy service following upstream DNS infrastructure changes if running an unpatched version.
• Integrate static analysis linters (such as golangci-lint and govet) into CI pipelines to catch dead stores on range-loop value copies.

Remediation Steps:

1. Update the Go module dependency by running: go get github.com/tinfoil-factory/[email protected]
2. Recompile and redeploy the netfoil binary across all affected environments.
3. Verify the fix by querying a cached DNS record twice across a time interval using dig and confirming that the returned TTL decreases.

References

• GitHub Advisory Database: GHSA-9ppr-wfw9-xvr2
• Netfoil Repository Security Advisory GHSA-9ppr-wfw9-xvr2
• Pull Request #44: Fix TTL
• Fix Commit ea42977900c864b7b1c42f26c5870c86008118a0
• Netfoil Release v0.6.1
• Netfoil Upstream GitHub Repository

Read the full report for GHSA-9PPR-WFW9-XVR2 on our website for more details including interactive diagrams and full exploit analysis.