Ftldns vulnerabilities

6 known vulnerabilities in Ftldns from Pi-hole. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  FTL: Improper Neutralization of CRLF Sequences

  CVE-2026-39849May 5, 2026Pi-hole

  Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. In versions before 6.6.1, the `dns.interface` configuration field in Pi-hole FTL accepted newline characters without validation, allowing an attacker to inject arbit

• 8.8 High severity

  FTL: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-35521Apr 7, 2026Pi-hole

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts

• 8.8 High severity

  FTL: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-35520Apr 7, 2026Pi-hole

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.

• 8.8 High severity

  FTL: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-35519Apr 7, 2026Pi-hole

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.h

• 8.8 High severity

  FTL: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-35518Apr 7, 2026Pi-hole

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns

• 8.8 High severity

  FTL: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-35517Apr 7, 2026Pi-hole

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (