AdGuard Home v0.107.78 released on 13-07-2026
AdGuard Home v0.107.78 is out now. It is a security-focused update that tightens DoH and DNSCrypt response validation, hardens QUIC handling (fixing unbounded reads), adds protections against JIGGLE attacks, disables H2C via HTTP/1.1 upgrade, updates the Go toolchain with fixes from Go 1.26.5, and limits rulelist sizes to prevent resource exhaustion.
See the project’s GitHub release page for the full changelog, advisories and upgrade instructions.
What’s in this release
- Multiple security mitigations: JIGGLE protection, stricter DoH and DNSCrypt response validation, QUIC unbounded-read fixes, and disabling H2C connection establishment (per RFC 9113).
- Configuration and limits: new filtering.max_http_size to cap HTTP request sizes for rulelists and an expanded filter update interval range of 0–8760 hours (365 days).
- Misc fixes and observability improvements: clearer updater logging, fix for invalid AA flags in DNS responses, corrected parsing of the ech parameter for HTTPS rewrite rules, and a fix for the blocked services check on the Custom filtering rules page.
Upgrade notes
- H2C via HTTP/1.1 request upgrade is no longer supported — review any upstreams or tooling that relied on H2C and adjust configurations accordingly.
- The release is built with an updated Go toolchain including fixes from Go 1.26.5; if you build AdGuard Home from source, use a Go toolchain that incorporates those fixes. If issues arise, revert to a previously known-good binary or restore from backups.
Please share feedback or report any issues on the project’s GitHub — community reports credited in the changelog helped produce these fixes, and your experience with the update is useful to maintainers and other users.
