CVE-2026-47703

MediumCVSS 5.3

Published: 15/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

Prior to version 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries.

Risk Assessment

An attacker could exploit the weakened DNS response matching to perform DNS spoofing or man-in-the-middle attacks, compromising the integrity and confidentiality of DNS traffic within the network.

Recommendation

Immediately upgrade AdGuard Home to version 0.107.75 or later, which contains the fix for this vulnerability.

Other vulnerabilities in AdGuard Home

CVE-2026-41448Critical
AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware.

Original NVD description (English source)

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS