medium5.3
CVE-2026-47703
AdGuard Home is a network-wide software for blocking ads and tracking.
Impact
AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/AdguardTeam/AdGuardHome | <= 0.107.74 | 0.107.75 |
| go | github.com/AdguardTeam/dnsproxy | < 0.81.3 | 0.81.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adguard | Adguardhome | before 0.107.75 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-xgx4-4h9w-53pv
- https://github.com/AdguardTeam/AdGuardHome/security/advisories/GHSA-xgx4-4h9w-53pv
- https://github.com/AdguardTeam/dnsproxy/commit/f00d992ce9567a50f596853978ad6500acfdcf1d
- https://nvd.nist.gov/vuln/detail/CVE-2026-47703
- https://pkg.go.dev/vuln/GO-2026-5756