CVE-2026-47703: AdGuard Home DNS DoS Vulnerability

CVE-2026-47703 Overview

CVE-2026-47703 affects AdGuard Home, a network-wide software for blocking ads and tracking. The vulnerability exists in versions prior to 0.107.75 within the client-triggered DNS-over-QUIC (DoQ) forwarding path to a udp:// upstream. The flawed logic reduces backend UDP DNS state entropy by producing dns_id=0 or txid=0 and exposes a quoted-port ICMP source-port oracle. These weaknesses degrade DNS response matching for forwarded queries and increase the risk of DNS cache poisoning or spoofing. The issue is fixed in AdGuard Home version 0.107.75. The weakness is classified under CWE-330 (Use of Insufficiently Random Values).

Critical Impact
Attackers can exploit reduced DNS transaction ID entropy and an ICMP source-port oracle to forge DNS responses forwarded through AdGuard Home, undermining the integrity of resolved domains.

Affected Products

AdGuard Home versions prior to 0.107.75
Deployments using DoQ client forwarding to udp:// upstreams
Networks relying on AdGuard Home for authoritative DNS filtering

Discovery Timeline

2026-07-15 - CVE-2026-47703 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47703

Vulnerability Analysis

AdGuard Home forwards DNS queries received over DNS-over-QUIC (DoQ) to configured upstream servers. When the upstream is specified with a udp:// scheme, the forwarding path constructs a new outbound UDP query. The vulnerable code produces a DNS transaction identifier (dns_id or txid) of 0 instead of a random 16-bit value. This eliminates one of the two primary entropy sources DNS resolvers rely on to match responses to outstanding queries.

Compounding the weakness, the implementation exposes a quoted-port ICMP source-port oracle. An off-path attacker can probe UDP source ports and infer the socket used for a pending upstream query. Combining a known transaction ID with a discovered source port makes response spoofing feasible without a machine-in-the-middle position.

Root Cause

The root cause is insufficient randomness [CWE-330] in DNS query construction along the DoQ-to-UDP forwarding path. The transaction ID generator returns zero, and the socket handling reveals port state through ICMP responses instead of silently discarding probes.

Attack Vector

Exploitation requires network reachability to the AdGuard Home instance and the ability to trigger DoQ client queries that are forwarded to a udp:// upstream. An attacker in a position to send ICMP probes and craft spoofed DNS responses can win the race against the legitimate upstream reply. Successful exploitation results in the resolver accepting attacker-controlled answers, which affects confidentiality and integrity of resolved records. Refer to the GitHub Security Advisory GHSA-xgx4-4h9w-53pv for full technical detail.

Detection Methods for CVE-2026-47703

Indicators of Compromise

Outbound UDP DNS queries originating from AdGuard Home with a transaction ID of 0x0000
Unexpected ICMP port-unreachable traffic patterns correlated with DNS resolution activity
DNS responses from unexpected source addresses matching outstanding forwarded queries

Detection Strategies

Inspect packet captures on the AdGuard Home host for outbound DNS queries with txid=0 to any udp:// upstream
Monitor for anomalous cache entries such as unusual A or CNAME records for high-value domains
Correlate DoQ client activity with UDP upstream traffic and flag responses that arrive from IPs outside the configured upstream set

Monitoring Recommendations

Enable AdGuard Home query logging and forward logs to a centralized analytics platform for anomaly review
Alert on repeated ICMP destination-unreachable messages targeting the AdGuard Home host
Baseline upstream response latency and flag responses that arrive impossibly fast, which can indicate spoofed replies

How to Mitigate CVE-2026-47703

Immediate Actions Required

Upgrade AdGuard Home to version 0.107.75 or later on all deployments
Audit upstream configurations and prefer encrypted transports such as DoT, DoH, or DoQ end-to-end instead of udp:// upstreams
Restrict which clients can reach the AdGuard Home DoQ listener to trusted networks only

Patch Information

AdGuard released the fix in AdGuard Home 0.107.75. The patch restores proper randomization of DNS transaction IDs on the DoQ-to-UDP forwarding path and removes the ICMP source-port oracle. See the GitHub Security Advisory GHSA-xgx4-4h9w-53pv for release details.

Workarounds

Replace udp:// upstreams with tls://, https://, or quic:// upstreams until the patch is applied
Block inbound ICMP responses to the AdGuard Home host at the perimeter firewall to reduce the source-port oracle
Disable the DoQ listener if it is not required for client connectivity

bash

# Configuration example: prefer encrypted upstream instead of udp://
upstream_dns:
  - "tls://1.1.1.1"
  - "https://dns.quad9.net/dns-query"
  - "quic://dns.adguard-dns.com"