Bullfrog's DNS over TCP bypasses domain filtering

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 15, 2025 · GitHub Advisory Database

   Detected

   ### Summary Using tcp breaks blocking and allows DNS exfiltration. ### PoC ### Impact sandbox bypass 

2. Sep 10, 2026 · GitHub Advisory Database

   Fix available

   bullfrogsec/bullfrog fixed in 0.8.4

3. Sep 10, 2026 · GitHub Advisory Database

   Fix available

   bullfrogsec/bullfrog fixed in 0.8.4

4. Sep 10, 2026 · GitHub Advisory Database

   Updated

   ### Summary Using tcp breaks blocking and allows DNS exfiltration. ### PoC ### Impact sandbox bypass 

Affected

• GitHub Actions bullfrogsec/bullfrog0 → 0.8.4

Sources

• CVE.orgVulnerability recordCVE-2025-47775

  Official CVE identifier

  cve.org
• GitHub Advisory DatabasePackage advisoryGHSA-m32f-fjw2-37v3

  GitHub Advisory Database record mirrored by OSV.

  github.com
• OSV.devPackage advisoryGHSA-m32f-fjw2-37v3

  Bullfrog's DNS over TCP bypasses domain filtering

  osv.dev

References

• PACKAGE · github.com
• WEB · github.com
• WEB · github.com
• WEB · github.com
• ADVISORY · nvd.nist.gov