What's worse than food poisoning? Cache poisoning, of course! In this update, we have fixed the vulnerability that was making AdGuard Home susceptible to cache poisoning attacks.
Acknowledgements
A special thanks to Xiang Li for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!
Full changelog
See also the v0.107.61 GitHub milestone.
Security
-
Any simultaneous requests that are considered duplicates will now only result in a single request to upstreams, reducing the chance of a cache poisoning attack succeeding. This is controlled by the new configuration object
pending_requests
, which has a singleenabled
property, set totrue
by default.NOTE: It's strongly recommended to leave it enabled, otherwise AdGuard Home will be vulnerable to untrusted clients.