CVE-2026-47703
AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.
- CVSS 4.0
- 6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-330, CWE-346
- Published
- Modified
- Record from
- the NVD, synced
Affected
- adguard:adguardhome
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xgx4-4h9w-53pv | Go | github.com/AdguardTeam/AdGuardHome | <0.107.75 | 0.107.75 |
| GHSA-xgx4-4h9w-53pv | Go | github.com/AdguardTeam/dnsproxy | <0.81.3 | 0.81.3 |
| GO-2026-5756 | Go | github.com/AdguardTeam/AdGuardHome | <0.107.75 | 0.107.75 |
| GO-2026-5756 | Go | github.com/AdguardTeam/dnsproxy | <0.81.3 | 0.81.3 |