Log message:
adguardhome: updated to 0.107.79

0.107.79

Security

Go version has been updated to prevent the possibility of exploiting the Go \ 
vulnerabilities fixed in 1.26.6.

AdGuard Home is now more resistant to resource exhaustion attacks when using \ 
DNS-over-QUIC.

This is GHSA-w6v6-f44j-3rj2. We thank @ATinyShoe for reporting this security issue.

Added

Bootstrap servers configuration now supports comments.

New property "language" in POST /control/install/check_config and POST \ 
/control/install/configure HTTP APIs.

The user is able to remove the static lease's hostname via the HTTP API.

Changed

The edge channel has been switched to the new UI and versioning scheme.

Deprecated

strict_sni_check is now deprecated.

Fixed

DNS64 treating unresolved CNAME/DNAME answers as the end of resolution chain

Blocked requests without an EDNS(0) OPT record

Log message:
Revbump all Go packages after Go 1.26 update

Log message:
adguardhome: updated to 0.107.78

0.107.78

Security

AdGuard Home is now more resistant to JIGGLE attacks.

This is GHSA-p5f5-3p5g-rfjw. We thank @Nora-Qiu for reporting this security issue.

AdGuard Home now validates responses from DoH upstreams more strictly.

This is GHSA-4qjf-2hgm-92q6. We thank @wallace0409 for reporting this security issue.

QUIC connections are now protected from unbounded reads.

This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @wallace0409 for \ 
reporting this security issue.

AdGuard Home now validates responses from DNSCrypt upstreams more strictly.

The H2C connection establishment via HTTP/1.1 request upgrade is no longer \ 
supported. See RFC 9113.

Go version has been updated to prevent the possibility of exploiting the Go \ 
vulnerabilities fixed in 1.26.5.

The size of rulelists is limited. This is necessary to prevent a user's machine \ 
from becoming overloaded if the filter source misbehaves.

We thank Damir (@Evelynkaz) for reporting this security issue.

Added

Improved updater logging to give users more insight into the problem with \ 
version updating

Changed

The interval of filter updates can now be set to any number of hours between 0 \ 
and 8760 (365 days) in the configuration file.

Configuration changes

The filtering object of the YAML configuration now includes a new property, \ 
max_http_size, which defines the maximum size of the HTTP request for rulelists. \ 
To disable the limitation, set a large size, such as 1 TB.
Fixed

Invalid AA flag in DNS responses

The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type

Blocked services check on the Custom filtering rules page does not work properly \ 
without specifying of a client.

Log message:
Revbump all Go packages after go126 update

Log message:
Revbump all Go packages after go126 security update

Log message:
adguardhome: updated to 0.107.77

0.107.77

Security

Authorization in GLiNET mode is no longer vulnerable to path traversal attacks.
NOTE: This is CVE-2026-41448. We thank @djnnvx for reporting this security issue.

Added

New reason query parameter in GET /control/querylog. See openapi/openapi.yaml \ 
for the full description.

Deprecated

Query parameter response_status in GET /control/querylog is now deprecated. Use \ 
new reason query parameter instead.

Log message:
adguardhome: updated to 0.107.76

0.107.76

Changed

Duration values in YAML configuration file now support d (days) units and has \ 
been updated.
NOTE: Any rollback to version below the v0.107.76 should convert the values back \ 
to hours.

Fixed

DNS caching with disabled DNSSEC

Log message:
adguardhome: updated to 0.107.75

0.107.75

We’ve fixed a critical vulnerability affecting DNS-over-QUIC and DNS-over-HTTPS
that could put your DNS privacy at risk. The gap is now closed, and your
encrypted traffic is back to traveling through a properly armored tunnel.