TI-2026-84453 Aliases GHSA-9ppr-wfw9-xvr2

Netfoil does not decrement TTL, so stale records are served

LOW 38CWE-672Published 2026-11-03 · Updated 2026-11-03

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: —
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

The Go package github.com/tinfoil-factory/netfoil from 0.3.0 before 0.6.1 does not decrement the TTL of its records. As a result, stale records continue to be served after they should have expired. This is classified as CWE-672, an operation on a resource after its expiration or release.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the GitHub advisory

### Summary TTL was not decremented, so stale records would continue to be served.

Why it matters now

Fix Fixed github.com/tinfoil-factory/netfoil (Go): 0.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	github.com/tinfoil-factory/netfoil (Go)	0.3.0 to before 0.6.1	0.6.1	Patch available	GHSA-9ppr-wfw9-xvr2

github.com/tinfoil-factory/netfoil (Go) Vendor— Affected 0.3.0 to before 0.6.1 Fixed in 0.6.1 Patch available GHSA-9ppr-wfw9-xvr2

Remediation

Update the Go package github.com/tinfoil-factory/netfoil to version 0.6.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Fix · GHSA-9ppr-wfw9-xvr2 github.com/tinfoil-factory/netfoil (Go) Fixed in 0.6.1 Advisory →

Timeline

2026-11-03 Threatist record created from GHSA-9ppr-wfw9-xvr2

References

Other 5

Sources

GHSA-9ppr-wfw9-xvr2 · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences