GHSA-84G5-X8J3-7235: DNS Filter Bypass via Off-by-one Error in Netfoil Suffix Trie

Vulnerability ID: GHSA-84G5-X8J3-7235

CVSS Score: 7.5

Published: 2026-04-29

Netfoil versions prior to v0.2.1 contain an off-by-one logic error within the custom suffix trie implementation used for domain matching. This flaw allows an attacker to bypass DNS allowlist configurations by prepending arbitrary characters to approved domain names.

TL;DR

An off-by-one error in Netfoil's domain matching logic ignores the first character of incoming domains, allowing attackers to bypass DNS filters by adding a prefix to allowed domains.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type : Incorrect allowlist enforcement

CWE ID : CWE-193, CWE-285

Attack Vector : Network

Impact : Security feature bypass (DNS filtering)

Exploit Status : Unauthenticated Bypass

Patch Status : Fixed in v0.2.1

Affected Systems

Netfoil DNS Proxy (< v0.2.1)

Netfoil : < 0.2.1 (Fixed in: v0.2.1 )

Code Analysis

Commit: 0ca054a

Fix…