CVE-2026-47703 | AdGuard Home is a network-wide software for blocking ads and… | CVSS 6.3 MEDIUM

Description

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.

Metadata

CVE ID: CVE-2026-47703
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-19 21:18 UTC
Published: 2026-07-15 16:03 UTC
Last updated: 2026-07-15 17:45 UTC
Primary CWE: CWE-330
CWE-330: Use of Insufficiently Random Values
Vendor / Product: AdguardTeam / AdGuardHome
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
AdguardTeam	AdGuardHome	—	< 0.107.75

Weakness (CWE)

CWE	Source	Description
CWE-330	cna	CWE-330: Use of Insufficiently Random Values
CWE-346	cna	CWE-346: Origin Validation Error

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References (1)

https://github.com/AdguardTeam/AdGuardHome/security/advisories/GHSA-xgx4-4h9w-53pv https://github.com/AdguardTeam/AdGuardHome/security/advisories/GHSA-xgx4-4h9w-53pv