This release includes 6 security fixes for security teams reviewing exposed deployments.
Topics
+3 more
Affected surfaces
ReleasePort's take
Moderate signalAdGuard Home v0.107.78 hardens security by resisting JIGGLE attacks and adding stricter validation for DoH, DNSCrypt, and QUIC communications while updating the Go runtime to 1.26.5.
Why it matters: Security enhancements (JIGGLE resistance, tighter DoH/DNSCrypt/QUIC checks) and a critical Go runtime upgrade to 1.26.5 mitigate known vulnerabilities; action required for deployments using H2C or vulnerable Go versions.
Summary
AI summaryMultiple security fixes including JIGGLE attack resistance, stricter DoH/DNSCrypt response validation, QUIC read limits, Go version bump to 1.26.5, and rulelist size limiting.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Resists JIGGLE attacks. Resists JIGGLE attacks. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Security | High |
Validates DoH upstream responses more strictly. Validates DoH upstream responses more strictly. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Security | High |
Protects QUIC connections from unbounded reads. Protects QUIC connections from unbounded reads. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Security | High |
Validates DNSCrypt upstream responses more strictly. Validates DNSCrypt upstream responses more strictly. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Security | High |
Updates Go runtime to 1.26.5 to mitigate known vulnerabilities. Updates Go runtime to 1.26.5 to mitigate known vulnerabilities. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Security | Medium |
Limits rulelist size to prevent overload from misbehaving filter sources. Limits rulelist size to prevent overload from misbehaving filter sources. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Breaking | High |
Discontinues H2C connection establishment via HTTP/1.1 request upgrade per RFC 9113. Discontinues H2C connection establishment via HTTP/1.1 request upgrade per RFC 9113. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Feature | Low |
Enhances updater logging to provide better insight into version update problems. Enhances updater logging to provide better insight into version update problems. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Corrects invalid AA flag in DNS responses. Corrects invalid AA flag in DNS responses. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Fixes parsing of `ech` parameter in DNS rewrite rules for HTTPS record type. Fixes parsing of `ech` parameter in DNS rewrite rules for HTTPS record type. Source: llm_adapter@2026-07-14 Confidence: high |
— |
Full changelog
Security, security, security, security, security!
No, we do not have Steve Ballmer for CEO, but we took a page out of his playbook to draw attention to what we think is one of the most important aspects of developing AdGuard Home — security. This update is a good illustration of that: security-related changes take up over half of the changelog, and it’s not a small one.
We thank our awesome community members who helped us immensely by reporting some of the vulnerabilities, so that we could stay on top of our game and deliver timely fixes.
Full changelog
See also the v0.107.78 GitHub milestone.
Security
-
AdGuard Home is now more resistant to JIGGLE attacks.
This is GHSA-p5f5-3p5g-rfjw. We thank @Nora-Qiu for reporting this security issue.
-
AdGuard Home now validates responses from DoH upstreams more strictly.
This is GHSA-4qjf-2hgm-92q6. We thank @wallace0409 for reporting this security issue.
-
QUIC connections are now protected from unbounded reads.
This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @wallace0409 for reporting this security issue.
-
AdGuard Home now validates responses from DNSCrypt upstreams more strictly.
-
The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See RFC 9113.
-
Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.5.
-
The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves.
We thank Damir (@Evelynkaz) for reporting this security issue.
Added
- Improved updater logging to give users more insight into the problem with version updating (#8410).
Changed
- The interval of filter updates can now be set to any number of hours between
0and8760(365 days) in the configuration file.
Configuration changes
- The
filteringobject of the YAML configuration now includes a new property,max_http_size, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as1 TB.
Fixed
-
Invalid AA flag in DNS responses (#7955).
-
The parsing of the
echparameter in DNS rewrite rules for the HTTPS record type (#8276). -
Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.
Breaking Changes
- H2C connection establishment via HTTP/1.1 request upgrade is no longer supported (per RFC 9113).
Security Fixes
- GHSA-p5f5-3p5g-rfjw — AdGuard Home now resists JIGGLE attacks.
- GHSA-4qjf-2hgm-92q6 — Stricter validation of responses from DoH upstreams.
- GHSA-qr92-rwvw-mhgh, GHSA-cccx-2r6r-m9r4 — QUIC connections now protected from unbounded reads.
- AdGuard Home now validates responses from DNSCrypt upstreams more strictly (unspecified CVE).
- Rulelist size is limited to prevent overload from misbehaving filter sources.
- Go runtime updated to 1.26.5 to mitigate Go vulnerabilities.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]