CVE-2026-47703

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47703
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47703.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47703
Aliases
Downstream
Related
Published
2026-07-15T16:03:17Z
Modified
2026-08-12T03:51:28Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
Details

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-330",
        "CWE-346"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47703.json"
}
References

Affected packages

Git / github.com/adguardteam/adguardhome

Affected ranges

Type
GIT
Repo
https://github.com/adguardteam/adguardhome
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
89ca8d58ab95d7234fa12c9bdb80013c4f7e40aa
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:adguard:adguardhome:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.107.75"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v0.*
v0.1
v0.100.0
v0.100.1
v0.100.2
v0.100.3
v0.100.4
v0.100.5
v0.100.6
v0.100.7
v0.100.8
v0.100.9
v0.101.0
v0.102.0
v0.103.0
v0.103.0-beta1
v0.103.0-beta2
v0.103.0-beta3
v0.103.1
v0.103.2
v0.103.3
v0.104.0
v0.104.0-beta1
v0.104.0-beta2
v0.104.0-beta3
v0.104.1
v0.105.0
v0.105.0-beta.3
v0.105.0-beta.4
v0.105.0-beta.5
v0.105.1
v0.105.1-beta.1
v0.105.2
v0.105.2-beta.1
v0.106.0
v0.106.0-b.1
v0.106.0-b.2
v0.106.0-b.3
v0.106.0-b.4
v0.106.0-b.5
v0.107.0
v0.107.0-b.1
v0.107.0-b.10
v0.107.0-b.11
v0.107.0-b.12
v0.107.0-b.13
v0.107.0-b.14
v0.107.0-b.15
v0.107.0-b.16
v0.107.0-b.17
v0.107.0-b.2
v0.107.0-b.3
v0.107.0-b.4
v0.107.0-b.5
v0.107.0-b.6
v0.107.0-b.7
v0.107.0-b.8
v0.107.0-b.9
v0.107.1
v0.107.10
v0.107.11
v0.107.12
v0.107.13
v0.107.14
v0.107.15
v0.107.16
v0.107.17
v0.107.18
v0.107.19
v0.107.2
v0.107.20
v0.107.21
v0.107.22
v0.107.23
v0.107.24
v0.107.25
v0.107.26
v0.107.27
v0.107.28
v0.107.29
v0.107.3
v0.107.30
v0.107.31
v0.107.32
v0.107.33
v0.107.34
v0.107.35
v0.107.36
v0.107.37
v0.107.38
v0.107.39
v0.107.4
v0.107.40
v0.107.41
v0.107.42
v0.107.43
v0.107.44
v0.107.45
v0.107.46
v0.107.47
v0.107.48
v0.107.49
v0.107.5
v0.107.50
v0.107.51
v0.107.52
v0.107.53
v0.107.54
v0.107.55
v0.107.56
v0.107.57
v0.107.58
v0.107.59
v0.107.6
v0.107.60
v0.107.61
v0.107.62
v0.107.63
v0.107.64
v0.107.65
v0.107.66
v0.107.67
v0.107.68
v0.107.69
v0.107.7
v0.107.70
v0.107.71
v0.107.72
v0.107.73
v0.107.74
v0.107.8
v0.107.9
v0.9
v0.9-hotfix1
v0.91
v0.92
v0.92-hotfix1
v0.92-hotfix2
v0.93
v0.95
v0.95-hotfix
v0.96
v0.96-hotfix
v0.97.0
v0.97.1
v0.98.0
v0.98.1
v0.99.0
v0.99.1
v0.99.2
v0.99.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47703.json"