v0.107.79

Compare Source

See also the v0.107.79 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.6.

• AdGuard Home is now more resistant to resource exhaustion attacks when using DNS-over-QUIC.

  This is GHSA-w6v6-f44j-3rj2. We thank @​ATinyShoe for reporting this security issue.

Added

• Bootstrap servers configuration now supports comments.

• New property "language" in POST /control/install/check_config and POST /control/install/configure HTTP APIs.

• The user is able to remove the static lease's hostname via the HTTP API.

Changed

• The edge channel has been switched to the new UI and versioning scheme.

Deprecated

• strict_sni_check is now deprecated.

Fixed

• DNS64 treating unresolved CNAME/DNAME answers as the end of resolution chain (#​7514).

• Blocked requests without an EDNS(0) OPT record (#​8183).

v0.107.78

Compare Source

See also the v0.107.78 GitHub milestone.

Security

• AdGuard Home is now more resistant to JIGGLE attacks.

  This is GHSA-p5f5-3p5g-rfjw. We thank @​Nora-Qiu for reporting this security issue.

• AdGuard Home now validates responses from DoH upstreams more strictly.

  This is GHSA-4qjf-2hgm-92q6. We thank @​wallace0409 for reporting this security issue.

• QUIC connections are now protected from unbounded reads.

  This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @​wallace0409 for reporting this security issue.

• AdGuard Home now validates responses from DNSCrypt upstreams more strictly.

• The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See RFC 9113.

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.5.

• The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves.

  We thank Damir (@​Evelynkaz) for reporting this security issue.

Added

• Improved updater logging to give users more insight into the problem with version updating (#​8410).

Changed

• The interval of filter updates can now be set to any number of hours between 0 and 8760 (365 days) in the configuration file.

Configuration changes

• The filtering object of the YAML configuration now includes a new property, max_http_size, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as 1 TB.

• Invalid AA flag in DNS responses (#​7955).

• The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type (#​8276).

• Validation of the answer field in DNS rewrite rules in case it is represented as CNAME.

• Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.

v0.107.77

Compare Source

See also the v0.107.77 GitHub milestone.

Security

• Authorization in GLiNET mode is no longer vulnerable to path traversal attacks.

  NOTE: This is CVE-2026-41448. We thank @​djnnvx for reporting this security issue.

Added

• New reason query parameter in GET /control/querylog. See openapi/openapi.yaml for the full description.

Deprecated

• Query parameter response_status in GET /control/querylog is now deprecated. Use new reason query parameter instead.