6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47703

CVE-2026-47703: AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47703

CVE-2026-47703:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/AdguardTeam/AdGuardHome	go	<= 0.107.74	0.107.75
github.com/AdguardTeam/dnsproxy	go	< 0.81.3	0.81.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the dnsproxy library, which is a dependency of AdGuard Home. The core issue is a lack of entropy in DNS transaction IDs when forwarding requests from DNS-over-QUIC (DoQ) to plain UDP upstreams. The analysis of the patch f00d992ce9567a50f596853978ad6500acfdcf1d in the dnsproxy repository clearly shows the fix. The function plainDNS.dialExchange in upstream/plain.go was modified to ensure that if a DNS request has a transaction ID of 0, a new random ID is generated before sending it to the upstream UDP server. Before the patch, the request was sent with the predictable ID of 0, creating a security risk. This is why plainDNS.dialExchange is identified as the vulnerable function. An attacker could exploit this by sending a forged DNS response with the known transaction ID of 0, potentially poisoning the DNS cache and redirecting users to malicious sites.

Vulnerable functions

plainDNS.dialExchange

upstream/plain.go

The `plainDNS.dialExchange` function in `dnsproxy` is responsible for forwarding DNS queries to upstream plain DNS servers. When a DNS-over-QUIC (DoQ) query was received and forwarded to a UDP upstream, this function did not ensure that the DNS transaction ID (txid) was properly randomized. Instead, it forwarded the query with a txid of 0. A predictable txid of 0 makes it significantly easier for an off-path attacker to craft a malicious DNS response that will be accepted, leading to DNS cache poisoning. The vulnerability lies in the failure to enforce entropy in the DNS transaction ID for forwarded queries.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.