GHSA-9ppr-wfw9-xvr2: Netfoil doesn't decrement TTL
Published Nov 3, 2026
·Updated
Summary TTL was not decremented, so stale records would continue to be served.
Affected Software
1 affected componentFixes available
go/github.com/tinfoil-factory/netfoil>=0.3.0<0.6.1
0.6.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/tinfoil-factory/netfoilto a version that resolves this vulnerability.Fixed in 0.6.1
Event History
Nov 3, 2026
Advisory Published
via GitHub·04:48 PM
Data Sourced
via GitHub·04:48 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the practical impact of this issue?
Netfoil may continue serving stale records because their TTL is not decremented. Consumers relying on TTL expiry may receive outdated DNS data longer than intended.
2
How can I determine whether my deployment is affected?
Review the Netfoil version or source in use and check whether it includes the fix from commit ea42977900c864b7b1c42f26c5870c86008118a0. Deployments that serve cached records are relevant because the issue concerns TTL handling.