Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M
CVE-2026-47703AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
Medium 6.3
In plain English
A medium-severity weak randomness in AdGuardHome from AdguardTeam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/AdguardTeam/AdGuardHome | 0.107.75 | GHSA-xgx4-4h9w-53pv |
| Go | github.com/AdguardTeam/AdGuardHome | 0.107.75 | GO-2026-5756 |
| Go | github.com/AdguardTeam/dnsproxy | 0.81.3 | GHSA-xgx4-4h9w-53pv |
| Go | github.com/AdguardTeam/dnsproxy | 0.81.3 | GO-2026-5756 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AdguardTeam | AdGuardHome | < 0.107.75 |
Weakness: CWE-330, CWE-346 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N