What’s Vulnerable › Vulnerabilities

CVE-2025-47775: Bullfrog's DNS over TCP bypasses domain filtering

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-14 · updated 2026-06-17
• Weakness: CWE-201

Description

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.

Affected products

• bullfrogsec bullfrog: before 0.8.4 — fixed in 0.8.4

How to fix

Upgrade to a fixed version: bullfrogsec bullfrog 0.8.4. Check the vendor advisory for mitigations.

References

• https://github.com/bullfrogsec/bullfrog/commit/ae7744ae4b3a6f8ffc2e49f501e30bf1a43d4671
• https://github.com/bullfrogsec/bullfrog/releases/tag/v0.8.4
• https://github.com/bullfrogsec/bullfrog/security/advisories/GHSA-m32f-fjw2-37v3
• https://github.com/bullfrogsec/bullfrog/security/advisories/GHSA-m32f-fjw2-37v3

Get alerted when CVE-2025-47775 or the next vulnerability affects your stack