8000 Releases · pi-hole/FTL · GitHub
[go: up one dir, main page]
Skip to content

Releases

Pi-hole FTL v6.8

Pi-hole FTL v6.8 Latest
Latest

Choose a tag to compare

View all tags
@PromoFaux PromoFaux released this 17 Oct 11:10
v6.8
29c8b13
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

This release fixes the following security advisories (credit to the reporters named):

High

Medium

Low

What's Changed

This is a minor release rather than v6.7.2: there are enough visible behaviour changes that a patch version would undersell it. It backports the bug fixes that landed on development since v6.7.1 and updates the embedded dnsmasq (v2.93+30) and SQLite (v3.53.3).

Improvements

  • The live log is now stored as a ring buffer instead of moving the whole buffer for every new line, which costs far less CPU per cached answer.
  • Internationalised domain names on lists are converted to punycode with libidn2 and block, instead of being rejected as invalid.
  • Long-term statistics are grouped before joining the name tables (faster), and two unused in-memory indexes are gone, saving about 22 MB per million queries.

Notable fixes

  • Flushing the logs deleted the whole long-term history, not only the last 24 hours, and moved the graph a day into the future.
  • Crashes with 257+ alias-clients, with a no-longer-forced FTLCONF_ array, and with database.DBinterval = 0.
  • Group and list changes not reaching a client until the next reload, stale forced replies, and missing EDE on the first block.
  • A file path containing + (or any other printable ASCII) was reset to its default on start-up.
  • An open redirect in the .lp compatibility redirect, and / ignoring webserver.serve_all.
  • Pi-hole's own certificate for a custom webserver.domain was never renewed, and a domain longer than 64 characters ended up as an oversized CN.
  • The empty-DS DNSSEC loop, via dnsmasq, plus its double-free and information disclosure fixes.
  • An API session could enable misc.readOnly through a Teleporter archive, and pihole.toml.lock failed on NFS.
  • Any LAN client could make FTL add a new PTR record for every spelling of its own address until a restart.
  • The CLI password file and pihole-tmp.db were briefly or permanently readable by everyone.
  • On ARM and RISC-V the MAC address of a new device was never looked up at query time, so its MAC-based groups only applied later.
  • Raising misc.privacylevel at runtime did not cover domains and clients already seen, and an ntp.sync.interval above about 24.8 days made the NTP client sync back to back.
  • DNS stalls on list reloads and rate limiting, GC double processing, lost queries at shutdown, and wrong long-term statistics.
  • Old queries were never deleted from pihole-FTL.db on a host that restarts FTL at least once a day.
  • dhcp-discover printed the DNSSL labels of Router Advertisements unescaped.
  • Clients without a MAC address (e.g. a WireGuard peer) stayed in the default group until the next list reload, because the groups of a new client were resolved before its interface was known.
  • The load check counted only the CPUs a container was limited to, while /proc/loadavg shows the host's load, so the long-term load warning fired spuriously and /api/info/system inflated the load percentage in LXC/Docker with fewer cores. FTL now counts all present host CPUs.
  • FTLCONF_files_log_ftl was not used for log lines on early startup.

Behaviour changes to be aware of

  • Invalid values found in pihole.toml are rejected and reset to the default: database.DBinterval of 0, a webserver.tls.cert below the webroot, a non-base32 webserver.api.totp_secret, relative paths for files FTL writes, and a files.tmp_db that names another file Pi-hole keeps (e.g. pihole-FTL.db). A webserver.api.maxHistory above 86400 is reduced to 86400. A list (e.g. dns.hosts) now loses only its invalid entries instead of being reset as a whole.
  • With webserver.serve_all = false, / under a host other than webserver.domain now returns a 404, so a custom index.html in the webroot no longer shows up at http://<ip>/. Behind a proxy that does not strip webserver.paths.prefix, the prefixed path returns a 404 as well.
  • A renewed self-signed certificate comes with a new CA, so an imported tls_ca.crt has to be imported again.
  • FTL no longer hands a symbolic link (e.g. pihole-FTL.db or FTL.log linked to another disk) to the pihole user, and warns about it on every start. Such a target has to be owned by pihole already.
  • When FTL runs as root it only changes ownership or permissions of regular files directly in /etc/pihole and /var/log/pihole, and refuses a symbolic link as log file (including files.log.dnsmasq). Started as pihole, a linked log file keeps working.
  • A blocking timer on an unchanged status now switches to the opposite mode when it expires.
  • The host's own interfaces show up in the network table, and shutdown may wait up to 30 seconds for a busy database thread.
  • dnsmasq adds the option4: syntax and DHCPv6 vendor classes.
  • Changing ntp.sync.interval restarts FTL, ntp.sync.count = 0 is rejected, and POST /api/action/gravity answers 409 while a run is in progress.
  • Queries older than database.maxDBdays are deleted in the first night after a start, 10000 at a time. A database that kept growing will lose its whole backlog in the first night after the update.
  • A v5 Teleporter import replaces the upstreams, reverse servers and excluded domains/clients instead of adding to them.

Full Changelog: v6.7.1...v6.8

Contributors

ChrisLundquist, Jgarcg40, and 5 other contributors
Assets 18
  • api-docs.tar.gz
    sha256:43417c1acbab4b57f4d2f71f68c676ad917a0b9716421002eb62747e9bf7e35c
    340 KB 2026-10-17T11:19:20Z
  • pihole-FTL-386
    sha256:555f3f5509a38b2be1cb8f5e2eb53ba1326e6aa181b4103bdedb9a78a5c449d6
    25.6 MB 2026-10-17T11:18:53Z
  • pihole-FTL-386.sha1
    sha256:f15796deb2ed58ddd255a3979695b5e5022e78474b465894edf0187e4f53a582
    57 Bytes 2026-10-17T11:18:53Z
  • pihole-FTL-amd64
    sha256:1f511e7053a5ddfae1db1f439ebb986dd8025bf7223e1f70fb8087d9c0fd2b0e
    27.7 MB 2026-10-17T11:19:20Z
  • pihole-FTL-amd64-clang
    sha256:2aab6340def1d87bcc743a59a161b738c3785fae11f900dbb3c90b5baf65a982
    17.1 MB 2026-10-17T11:15:56Z
  • pihole-FTL-amd64-clang.sha1
    sha256:25969f184dd2918fe469b222df96ef7e320fbc9bd1b3a3fafa31cd992f27d135
    65 Bytes 2026-10-17T11:15:56Z
  • pihole-FTL-amd64.sha1
    sha256:2a6e32d41f17d6c6910512c5bb234879c0fa2e4683ae582d2aaa06b64fa0f023
    59 Bytes 2026-10-17T11:19:20Z
  • pihole-FTL-arm64
    sha256:e728cbcffa43b23e3b06fc10faa2fb0a22399d5931fc9881e4007491ee978e6f
    28 MB 2026-10-17T11:16:20Z
  • pihole-FTL-arm64.sha1
    sha256:b39da8cf9a106f879253e24638340385a2bc0dd4d434e43cb05a9a9212d34f09
    59 Bytes 2026-10-17T11:16:20Z
  • pihole-FTL-armv6
    sha256:84fddcea66adebc09fe7c65e42f75aedc2f9c61b2089139193d21a670de00bae
    27 MB 2026-10-17T11:18:00Z
  • Source code (zip)
    2026-10-17T11:08:09Z
  • Source code (tar.gz)
    2026-10-17T11:08:09Z

Pi-hole FTL v6.7.1

Pi-hole FTL v6.7.1

Choose a tag to compare

View all tags
@DL6ER DL6ER released this 19 Sep 19:14
v6.7.1
0bf029b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Fixes

Behavior changes

  • misc.dnsmasq_lines and webserver.advancedOpts can no longer be changed through the API or the web interface. They can still be set in pihole.toml, through environment variables and with pihole-FTL --config.
  • Wrong-method API requests now return 405 with an Allow header, and OPTIONS names only the methods of the endpoint that fits the URI best.
  • The CAP_NET_RAW startup warning is gone, dnsmasq reports it when it actually needs the capability.
  • database.maxDBdays is an unsigned value now. A negative value kept the queries forever and is migrated to 4294967295, which continues to do so.

Fixes of note

  • pi.hole and the local host name were answered with NODATA until restart once the interface cache went stale (#3050)
  • An infinite loop in the dnsmasq config test when debug.config is enabled
  • Webserver workers spinning at 100% CPU in the mbedTLS debug callback (#3106)
  • Async-signal-safety in the real-time signal handler and the TCP worker terminator
  • Query indices that went stale while the shared memory lock was released, and a domain lookup that gave up at once when a list change was being committed
  • Database connection leaks and counter skew, gravity regex and search-term handling, config write races, API error paths and response correctness
  • Memory-safety hardening in the netlink parsers, get_api_string(), base64_decode_update() and arp-scan

Full Changelog: v6.7...v6.7.1

Loading

v6.7

v6.7

Choose a tag to compare

View all tags
@PromoFaux PromoFaux released this 06 Jul 20:10
v6.7
fa65a88
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Fixes

What's Changed

New Contributors

Full Changelog: v6.6.2...v6.7

Contributors

slmingol, rdwebdesign, and 9 other contributors
Loading

Pi-hole FTL v6.6.2

Pi-hole FTL v6.6.2

Choose a tag to compare

View all tags
@DL6ER DL6ER released this 11 May 19:45
v6.6.2
82c58cc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

dnsmasq security update

This release imports six upstream dnsmasq security fixes, covering all publicly disclosed CVEs against the dnsmasq 2.92/2.93 line. Patches are taken verbatim from https://thekelleys.org.uk/dnsmasq/CVE/

CVEs fixed

  • CVE-2026-2291 — Heap OOB write in struct bigname. The on-heap namebuffer was sized for the wire form of a domain name (MAXDNAME) rather than its escaped internal form (MAXDNAME*2 + 1). A remote peer that can send or answer DNS queries could cause a large out-of-bounds write on the heap. Reported by Andrew S. Fasano.

  • CVE-2026-4890 — DNSSEC denial of service via NSEC bitmap parsing.The window-iteration step omitted the 2-byte window header, so a crafted NSEC record with bitmap_length == 0 produced an infinite loop and dnsmasq stopped answering queries. Reachable before RRSIG validation,so no valid signatures are required to trigger it. Reported by Royce M.

  • CVE-2026-4891 — DNSSEC crash via crafted RRSIG. A packet declaring an rdlen smaller than the fixed RRSIG header plus signer's name produced a negative signature length and a subsequent crash. Reported by Royce M.

  • CVE-2026-4892 — Privileged buffer overflow in the DHCP helper.When --dhcp-script is configured, hex-encoded DHCPv6 client identifiers (up to 65535 bytes) were written into a 5131-byte buffer in the root-privileged helper. Reported by Royce M.

  • CVE-2026-4893 — EDNS Client Subnet validation bypass. With--add-subnet enabled, process_reply() passed the OPT record length(~23 bytes) to check_source() instead of the packet length, causing every internal bounds check to fail and the validation routine to always return success. ECS source validation per RFC 7871 §9.2 was effectively disabled. Reported by Royce M.

  • CVE-2026-5172 — Heap OOB read in extract_addresses(). A mismatched RR rdlen allowed extract_name() to advance past the computed end of the record, underflowing the remaining-bytes calculation and producing a large OOB read with certain crash.Reported by Hugo Martinez Ray.

Upgrade impact

All six fixes are minimal, self-contained changes to the embedded dnsmasq sources. No FTL-side configuration or API changes; users should see no observable behavior change beyond the closed vulnerabilities.

Fix dnsmasq CVE publications by @DL6ER in #2888

This furthermore indirectly fixes #2871 due to pi-hole/docker-base-images#158

Full Changelog: v6.6.1...v6.6.2

Contributors

DL6ER
Loading

v6.6.1

v6.6.1

Choose a tag to compare

View all tags
@PromoFaux PromoFaux released this 24 Apr 21:35
v6.6.1
e1b4c1d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • Add new GET /api/config/_properties endpoint by @DL6ER in #2356
  • Fix thread-safety issues causing SIGSEGV under concurrent API load by @DL6ER in #2835
  • fix: fix rare race condition for SHM strings in API handlers by @DL6ER in #2833
  • Accept punycode domains that libidn2 rejects under IDNA2008 by @DL6ER in #2838
  • Improve shutdown diagnostics to identify SIGTERM source by @DL6ER in #2839
  • Resolve empty backtraces when addr2line is not installed by @DL6ER in #2831
  • Improve thread-safety for concurrent API requests by @DL6ER in #2847
  • Don't skip device lookup when resolver.macNames is disabled by @DL6ER in #2846
  • Fix linker error when compiling w/o optimization by @aeolio in #2850
  • Clarify dns.blockESNI wording by @darkexplosiveqwx in #2784
  • Preserve log file path config when fopen fails by @DL6ER in #2834

Security advisories

New Contributors

Full Changelog: v6.6...v6.6.1

Contributors

aeolio, DL6ER, and darkexplosiveqwx
Loading

v6.6

v6.6

Choose a tag to compare

View all tags
@PromoFaux PromoFaux released this 03 Apr 16:42
v6.6
71b6fc6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • Fix possible resolver issue on armv5tel by @DL6ER in #2781
  • Introduce CMake options for optional dependencies by @aeolio in #2795
  • Fix build without mbedtls [v2] by @aeolio in #2796
  • Fix overTime data when database.DBimport = false by @DL6ER in #2788
  • Fix cross-compilation issues w/ custom toolchain by @aeolio in #2797
  • Add new option for controling name resolution via MAC address by @DL6ER in #2790
  • Fix obtaining client groups by name by @DL6ER in #2791
  • Ensure API sessions are restored before starting the HTTP server by @DL6ER in #2803
  • Add form-action 'self' to Content-Security-Policy by @yubiuser in #2804
  • Add query_frequency to /padd endpoint by @yubiuser in #2806
  • Guard query-count counters against unsigned underflow by @DL6ER in #2815
  • Add universal crash backtrace via _Unwind_Backtrace by @DL6ER in #2811
  • config: show totp_secret presence in CLI output by @DL6ER in #2813
  • Fix client count inflation for rate-limited queries by @DL6ER in #2814
  • Fix stack buffer overflow in get_process_name() by @DL6ER in #2821
  • Do not restart FTL while pihole -g is still ongoing by @DL6ER in #2419

Security Advisories

New Contributors

Full Changelog: v6.5...v6.6

Contributors

aeolio, DL6ER, and 3 other contributors
Loading 10000

v6.5

v6.5

Choose a tag to compare

View all tags
@PromoFaux PromoFaux released this 17 Feb 20:20
v6.5
f888309
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • Tweak undocumented wait-for option subtly by @DL6ER in #2707
  • update gravity - improve domain validation processing speed by @rrobgill in #2710
  • Update embedded SQLite3 to 3.51.1 by @DL6ER in #2731
  • Update embedded dnsmasq to 2.92rc1 by @DL6ER in #2730
  • Fix documentation - Do not use equal sign with pihole-FTL --config command by @rdwebdesign in #2736
  • Add dns.cache.rrtype by @Manakuremati in #2740
  • Enhancements to the documentation markdown generator by @PromoFaux in #2741
  • Network Overview - obtain MAC and hostname from dhcp.leases by @rrobgill in #2727
  • fix: make get_domains parameters optional by @tien in #2278
  • Escape unprintable characters in invalid host names by @DL6ER in #2601
  • Implement better allOf handling in API verifier by @DL6ER in #2745
  • Update build containers to Alpine 3.23 by @DL6ER in #2743
  • Add option to hide network connection errors by @DL6ER in #2749
  • Harden default Content Security Policy (CSP) by @Erasure5959 in #2754
  • Fix computation of NTP server's root delay by @DL6ER in #2760
  • Teleporter: Fix for custom gravity.db path by @DL6ER in #2758
  • Upgrade embedded Lua to 5.5 by @DL6ER in #2626
  • Add missing [forwarded] property in GET /api/history/database by @DL6ER in #2750
  • Update SQLite3 to 3.51.2 by @DL6ER in #2761
  • Low-memory hardware optimizations by @DL6ER in #2757
  • Reduce startup delay by @DL6ER in #2725
  • home.arpa and internal TLDs may be non-local without revServer by @DL6ER in #2772

New Contributors

Full Changelog: v6.4.1...v6.5

Contributors

rdwebdesign, PromoFaux, and 5 other contributors
Loading

v6.4.1

v6.4.1

Choose a tag to compare

View all tags
@PromoFaux PromoFaux released this 27 Nov 18:20
v6.4.1
8d1add8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Nothing to see here - accidentally tagged the wrong commit for the big 6.4 release. Content is exactly the same as v6.4

What's Changed

  • Fix API specs and example for dns.upstreams in config.yaml by @rdwebdesign in #2696
  • gravity update - silently discard unicode BOM if present by @rrobgill in #2702
  • Update embedded SQLite to 3.51.0 by @DL6ER in #2704
  • Get earliest query timestamp from database by @PromoFaux in #2706
  • Increase buffer length for query string by @mwoolweaver in #2709
  • Reduce DNS resolver locking during database interaction by @DL6ER in #2700
  • Make colour output optional in streaming gravity API call by @PromoFaux in #2718
  • api/dhcp/leases Allow for hwaddr > 48 bits by @rrobgill in #2724
  • Add rate-limiting for TOTP validation by @DL6ER in #2719
  • Implement simple partial matching for regex in /api/search/{domain} by @DL6ER in #2705
  • Performance optimizations: string processing, memory management, and compiler flags by @Copilot in #2571
  • Fix authentication redirect when webhome is / (fixes #2518) by @averyvigolo in #2610
  • Reduce database locking and add timing debug setting by @DL6ER in #2688

New Contributors

Full Changelog: v6.3.3...v6.4.1

Contributors

rdwebdesign, PromoFaux, and 4 other contributors
Loading

v6.4

v6.4

Choose a tag to compare

View all tags
@PromoFaux PromoFaux released this 27 Nov 18:02
v6.4
3a2647d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • Fix API specs and example for dns.upstreams in config.yaml by @rdwebdesign in #2696
  • gravity update - silently discard unicode BOM if present by @rrobgill in #2702
  • Update embedded SQLite to 3.51.0 by @DL6ER in #2704
  • Get earliest query timestamp from database by @PromoFaux in #2706
  • Increase buffer length for query string by @mwoolweaver in #2709
  • Reduce DNS resolver locking during database interaction by @DL6ER in #2700
  • Make colour output optional in streaming gravity API call by @PromoFaux in #2718
  • api/dhcp/leases Allow for hwaddr > 48 bits by @rrobgill in #2724
  • Add rate-limiting for TOTP validation by @DL6ER in #2719
  • Implement simple partial matching for regex in /api/search/{domain} by @DL6ER in #2705
  • Performance optimizations: string processing, memory management, and compiler flags by @Copilot in #2571
  • Fix authentication redirect when webhome is / (fixes #2518) by @averyvigolo in #2610
  • Reduce database locking and add timing debug setting by @DL6ER in #2688

New Contributors

Full Changelog: v6.3.3...v6.4

Contributors

rdwebdesign, PromoFaux, and 4 other contributors
Loading

Pi-hole FTL v6.3.3

Pi-hole FTL v6.3.3

Choose a tag to compare

View all tags
@DL6ER DL6ER released this 04 Nov 19:22
v6.3.3
a0186fd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • Fix crash in NTP error handling code by @DL6ER in #2684
  • Add validation for ntp.sync.server by @DL6ER in #2667
  • Be more explicit about required path and query parameters for list manipulation by @yubiuser in #2689
  • Pi-hole FTL v6.3.3 by @DL6ER in #2693

Full Changelog: v6.3.2...v6.3.3

Contributors

DL6ER and yubiuser
Loading
0