CVE-2026-47703

Name of the Vulnerable Software and Affected Versions dnsproxy version 0.81.2 AdGuard Home version 0.107.74

Description A state reduction issue exists in the client-triggered DNS over QUIC (DoQ) forwarding path when queries are forwarded to a UDP upstream. In this path, the backend DNS ID (transaction ID) is not preserved as an independent source of entropy and instead collapses to 0 for every sampled client-triggered query. This reduces the backend tuple from a combination of (txid, source-port) to only the source-port.

This behavior creates a source-port oracle, where an attacker can distinguish the correct backend UDP source port from an incorrect one through stable, client-visible behavior changes. For dnsproxy, a correct port guess can steer resolution away from the primary UDP upstream into a fallback upstream. For AdGuard Home, it results in a fast SERVFAIL and an additional backend query. This reduction in entropy places the system in a threat-model class similar to oracle-assisted DNS forgery, as an off-path attacker only needs to determine the source port to attempt a forged response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.