Improper Output Neutralization for Logs Affecting github.com/tinfoil-factory/netfoil/dns package, versions <0.3.0

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the readDomain parser in dns/dns.go. An attacker can write attacker-controlled domain labels into logs by supplying a DNS name containing disallowed characters, because the parser accepted each label and joined it into the domain string without first validating the label contents. The resulting log entries can be polluted or manipulated depending on how downstream systems consume them, which can mislead operators or break log parsing and alerting.

Notes

• The vulnerable path is in DNS name parsing, so this only affects deployments that decode network DNS messages through readDomain; ordinary consumers that never parse attacker-supplied DNS payloads are not exposed.
• The issue is in the domain-label handling path before logging, so any downstream log pollution depends on the application actually emitting the parsed name from this parser into its logs rather than discarding it.

• GitHub Commit
• Maintainer's Advisory