Adguard Adguardhome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Adguard Adguardhome: 2 record(s), with affected versions and fixes.cpe:2.3:a:adguard:adguardhome
CVE-2026-47703
Medium · 5.3
CWE-330 Jul 15, 2026
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.
CVE-2026-32136
Critical · 9.8
CWE-287 Mar 11, 2026
AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass
AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. This vulnerability is fixed in 0.107.73.