AdGuardHome v1.0.0-b.1

Changes compared to the previous beta, v0.108.0-b.91. See CHANGELOG.md for all changes.

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.27.1.

Fixed

• Reading partially received TCP prefix.

• A panic when updating AdGuard Home binary via the command line with use_private_ptr_resolvers set to true (#8613).

Changed

• The beta channel has been switched to the new UI and versioning scheme.

Removed

• The support for macOS 13 Ventura, see Go 1.27 release notes.

AdGuardHome v0.108.0-b.91

Changes compared to the previous beta, v0.108.0-b.90. See CHANGELOG.md for all changes.

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.8.

Fixed

• log.enabled set to false leaving the legacy logger enabled (#8565).

• DHCP server persisting uncommitted leases with zero expiry after DHCPDISCOVER messages (#8572).

• DNS64 treating unresolved CNAME/DNAME answers as the end of resolution chain (#7514).

AdGuard Home v0.107.79

It’s not always the big issues: sometimes what you need is a few fixes and tweaks to pump up the overall stability 🔩

Full changelog

See also the v0.107.79 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.6.

• AdGuard Home is now more resistant to resource exhaustion attacks when using DNS-over-QUIC.

  This is GHSA-w6v6-f44j-3rj2. We thank @ATinyShoe for reporting this security issue.

Added

• Bootstrap servers configuration now supports comments.

• New property "language" in POST /control/install/check_config and POST /control/install/configure HTTP APIs.

• The user is able to remove the static lease's hostname via the HTTP API.

Changed

• The edge channel has been switched to the new UI and versioning scheme.

Deprecated

• strict_sni_check is now deprecated.

Fixed

• DNS64 treating unresolved CNAME/DNAME answers as the end of resolution chain (#7514).

• Blocked requests without an EDNS(0) OPT record (#8183).

AdGuard Home v0.108.0-b.90

Changes compared to the previous beta, v0.108.0-b.89. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to @ATinyShoe for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• AdGuard Home is now more resistant to resource exhaustion attacks when using DNS-over-QUIC.

  This is GHSA-w6v6-f44j-3rj2. We thank @ATinyShoe for reporting this security issue.

Added

• Bootstrap servers configuration now supports comments.

• The user is able to remove the static lease's hostname via the HTTP API.

Changed

• The edge channel has been switched to the new UI and versioning scheme.

Deprecated

• strict_sni_check is now deprecated.

Fixed

• Blocked requests without an EDNS(0) OPT record (#8183).

AdGuard Home v0.108.0-b.89

Changes compared to the previous beta, v0.108.0-b.88. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to @Nora-Qiu, @wallace0409, @Evelynkaz, and @N0zoM1z0 for reporting the vulnerabilities, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• AdGuard Home is now more resistant to JIGGLE attacks.

  This is GHSA-p5f5-3p5g-rfjw. We thank @Nora-Qiu for reporting this security issue.

• AdGuard Home now validates responses from DoH upstreams more strictly.

  This is GHSA-4qjf-2hgm-92q6. We thank @wallace0409 for reporting this security issue.

• QUIC connections are now protected from unbounded reads.

  This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @wallace0409 for reporting this security issue.

• AdGuard Home now validates responses from DNSCrypt upstreams more strictly.

• The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See RFC 9113.

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.5.

• The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves.

  We thank Damir (@Evelynkaz) for reporting this security issue.

• QUIC connections now observe timeouts more strictly.

  This is GHSA-73vv-3434-p64c. We thank @N0zoM1z0 for reporting this security issue.

Added

• Improved updater logging to give users more insight into the problem with version updating (#8410).

Changed

• The interval of filter updates can now be set to any number of hours between 0 and 8760 (365 days) in the configuration file.

Configuration changes

• The filtering object of the YAML configuration now includes a new property, max_http_size, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as 1 TB.

Fixed

• Validation of the answer field in DNS rewrite rules in case it is represented as CNAME.

• Invalid AA flag in DNS responses (#7955).

• The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type (#8276).

• Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.

AdGuard Home v0.107.78

Security, security, security, security, security!

No, we do not have Steve Ballmer for CEO, but we took a page out of his playbook to draw attention to what we think is one of the most important aspects of developing AdGuard Home — security. This update is a good illustration of that: security-related changes take up over half of the changelog, and it’s not a small one.

We thank our awesome community members who helped us immensely by reporting some of the vulnerabilities, so that we could stay on top of our game and deliver timely fixes.

Full changelog

See also the v0.107.78 GitHub milestone.

Security

• AdGuard Home is now more resistant to JIGGLE attacks.

  This is GHSA-p5f5-3p5g-rfjw. We thank @Nora-Qiu for reporting this security issue.

• AdGuard Home now validates responses from DoH upstreams more strictly.

  This is GHSA-4qjf-2hgm-92q6. We thank @wallace0409 for reporting this security issue.

• QUIC connections are now protected from unbounded reads.

  This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @wallace0409 for reporting this security issue.

• AdGuard Home now validates responses from DNSCrypt upstreams more strictly.

• The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See RFC 9113.

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.5.

• The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves.

  We thank Damir (@Evelynkaz) for reporting this security issue.

Added

• Improved updater logging to give users more insight into the problem with version updating (#8410).

Changed

• The interval of filter updates can now be set to any number of hours between 0 and 8760 (365 days) in the configuration file.

Configuration changes

• The filtering object of the YAML configuration now includes a new property, max_http_size, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as 1 TB.

Fixed

• Invalid AA flag in DNS responses (#7955).

• The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type (#8276).

• Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.

AdGuard Home v0.108.0-b.88

Changes compared to the previous beta, v0.108.0-b.87. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to @djnnvx for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• Authorization in GLiNET mode is no longer vulnerable to path traversal attacks.

  NOTE: This is CVE-2026-41448. We thank @djnnvx for reporting this security issue.

Fixed

• Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.

AdGuard Home v0.107.77

The quality of a product is not defined solely by code or developers’ technical prowess. A strong community—or the lack of one—can often make or break how successful a piece of software will be. We are very lucky to have such a devoted and passionate community around AdGuard Home. This update has once again demonstrated this, as we were able to quickly address a vulnerability reported by one of our community members.

Acknowledgments

A special thanks to @djnnvx for reporting the vulnerability, our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.77 GitHub milestone.

Security

• Authorization in GLiNET mode is no longer vulnerable to path traversal attacks.

  NOTE: This is CVE-2026-41448. We thank @djnnvx for reporting this security issue.

Added

• New reason query parameter in GET /control/querylog. See openapi/openapi.yaml for the full description.

Deprecated

• Query parameter response_status in GET /control/querylog is now deprecated. Use new reason query parameter instead.

AdGuard Home v0.108.0-b.87

Changes compared to the previous beta, v0.108.0-b.86. See CHANGELOG.md for all changes.

Full changelog

Changed

• Duration values in YAML configuration file now support d (days) units and has been updated.

  NOTE: Any rollback to version below the v0.107.76 should convert the values back to hours.

Fixed

• DNS caching with disabled DNSSEC (#8384).

AdGuard Home v0.107.76

They say: don’t fix it if it’s not broken. But what if it is, in fact, broken? Like the cache we may have accidentally messed up during the last update?  For such cases, there are hotfixes!  Make sure to install the today’s update in order to fix the cache on your AdGuard Home.

Acknowledgments

A special thanks to our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.76 GitHub milestone.

Changed

• Duration values in YAML configuration file now support d (days) units and has been updated.

  NOTE: Any rollback to version below the v0.107.76 should convert the values back to hours.

Fixed

• DNS caching with disabled DNSSEC (#8384).