CVE-2026-44693

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pi-hole/FTL/releases/tag/v6.6.1
https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7
https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-10 23:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-44693

Mitre link : CVE-2026-44693

CVE.ORG link : CVE-2026-44693

JSON object : View

Products Affected

No product.

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-44693", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44693", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pi-hole", "product": "FTL", "versions": [{"status": "affected", "version": "< 6.6.1"}]}]}], "published": "2026-06-10T23:16:46.690", "references": [{"url": "https://github.com/pi-hole/FTL/releases/tag/v6.6.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7", "source": "security-advisories@github.com"}, {"url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1."}, {"lang": "es", "value": "Pi-hole FTL es el motor principal del bloqueador de anuncios y rastreadores a nivel de red de Pi-hole. Antes de la versi\u00f3n 6.6.1, Pi-hole FTL contiene una vulnerabilidad de condici\u00f3n de carrera en el subsistema de gesti\u00f3n de sesiones HTTP, introducida con la reescritura v6.0 del servidor web embebido basado en CivetWeb. Este problema ha sido parcheado en la versi\u00f3n 6.6.1."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "security-advisories@github.com"}