Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-44693

Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pi-hole FTL

  • < 6.6.1affected

References