CVE-2026-47703: AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-15 · updated 2026-10-24
Weakness: CWE-330

Description

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.

Affected products

AdguardTeam AdGuardHome: before 0.107.75 — fixed in 0.107.75

How to fix

Upgrade to a fixed version: AdguardTeam AdGuardHome 0.107.75. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-47703 or the next vulnerability affects your stack