Tag to update to the latest Alpine image with fixes for high profile CVEs (shouldn't affect Pi-hole, but always pays to be safe)

What's Changed

• Update Alpine base image to version 3.24.3 by @rdwebdesign in #2086
• ci: skip layer cache for scheduled nightly builds by @PromoFaux in #2091
• Development -> master by @PromoFaux in #2092

Full Changelog: 2026.10.0...2026.10.1

What's Changed (Docker Specific)

• Trust Core and Web repositories for the pihole user (GHSA-xch2-4qxw-g5vj) by @PromoFaux in #2079
• fix: fail closed on FTL and GitHub release downloads by @lbellows in #2069
• Do not xtrace the Docker secret web password by @lbellows in #2077
• build(deps): Bump alpine from 3.24.1 to 3.24.2 in /src by @dependabot in #2078

Full Changelog: 2026.09.0...2026.10.0

Security Fixes

This release includes fixes for 17 security advisories across FTL, Web and Core.

• pi-hole/FTL/security/advisories/GHSA-2h7g-g549-hf74 — Authenticated File Read and Fix Bypass (High) reported by abdoghazy2015, Jgarcg40
• pi-hole/pi-hole/security/advisories/GHSA-cf36-4hhc-8398 — Local privilege escalation from pihole user to root via CVE-2026-41489 fix bypass (High) reported by abdoghazy2015
• pi-hole/pi-hole/security/advisories/GHSA-j8vh-6fp9-cjcx — Local privilege escalation through pihole-FTL ambient CAP_CHOWN capability (High) reported by keithlinneman
• pi-hole/pi-hole/security/advisories/GHSA-mff6-cjc4-5wq9 — Pi-hole: gravity.sh chowns arbitrary directory to pihole via files.gravity config path (root LPE) (High) reported by KimiSecurityTeam, keithlinneman, Pedromdsn
• pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj — arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink (High) reported by keithlinneman, KimiSecurityTeam
• pi-hole/FTL/security/advisories/GHSA-667h-gpmh-7gxc — Authenticated Arbitrary File Read via file:// Blocklists in Pi-hole (FTL / Web v6) (Moderate) reported by Rakan78
• pi-hole/FTL/security/advisories/GHSA-8fc6-q9x4-892v — Unauthenticated CHAOS/TXT DNS queries overflow pihole-FTL's shared stat buffer (DNS denial of service) (Moderate) reported by dagadjno
• pi-hole/FTL/security/advisories/GHSA-v53r-4564-3449 — App-password and CLI sessions can read all admin auth secrets (Moderate) reported by Pedromdsn
• pi-hole/FTL/security/advisories/GHSA-xj4x-gf2g-r6m7 — an EDNS option from one query can be applied to another client's query (Moderate) reported by 010011110
• pi-hole/FTL/security/advisories/GHSA-322h-f873-hp54 — Any website can read and change a Pi-hole v6 without a password through a LAN user's browser (CORS "*" + CSRF + DNS rebinding) (Low) reported by ChrisLundquist
• pi-hole/FTL/security/advisories/GHSA-9828-2f2q-2c8v — authenticated use-after-free in the domain search API during a list reload crashes the resolver (Low) reported by 010011110
• pi-hole/FTL/security/advisories/GHSA-mqr7-j2p5-5495 — authenticated double free in the domain-list regex validation API crashes the resolver (Low) reported by 010011110
• pi-hole/FTL/security/advisories/GHSA-v8mj-cqgw-63rj — Use-after-free of DHCP leases: DELETE /api/dhcp/leases frees a lease on a worker thread while dnsmasq's main thread prunes the same list (Low) reported by 010011110
• pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6 — file:// adlist read check and curl can resolve different files (Low)
• pi-hole/web/security/advisories/GHSA-3vhj-5284-xrmm — Stored XSS / HTML injection in DNS's Conditional Forwarding (Low) reported by KHr00t
• pi-hole/web/security/advisories/GHSA-qfpp-28mj-pj6p — Stored XSS / HTML injection in Local DNS Records (Low) reported by KHr00t
• pi-hole/web/security/advisories/GHSA-rmr4-hqc8-825f — Stored XSS in All Settings (Low) reported by KHr00t

Component Releases

Release notes for the components included in this image:

• Pi-hole FTL v6.8
• Pi-hole Web v6.6.1
• Pi-hole Core v6.5

Whats Changed? (Docker)

Nothing Docker specific, tagging to include FTL v6.7.1

Full Changelog: 2026.07.1...2026.09.0

Whats Changed? (FTL v6.7.1)

Security Fixes

• pi-hole/FTL/security/advisories/GHSA-2794-hrj8-5jg9 - Remote code execution and arbitrary file read via webserver.advancedOpts (High) reported by keithlinneman
• pi-hole/FTL/security/advisories/GHSA-ww5x-xx4x-qvjr - Remote code execution via exec-capable options in misc.dnsmasq_lines (High) reported by keithlinneman
• pi-hole/FTL/security/advisories/GHSA-gx63-h4w6-f46g - Configuration validators can be bypassed via Teleporter import, combined changes and document-root relocation (High)
• pi-hole/FTL/security/advisories/GHSA-7997-2868-rjfg - Stack buffer overflow in the blocked-answer path (Moderate) reported by 010011110

Behavior changes

• misc.dnsmasq_lines and webserver.advancedOpts can no longer be changed through the API or the web interface. They can still be set in pihole.toml, through environment variables and with pihole-FTL --config.
• Wrong-method API requests now return 405 with an Allow header, and OPTIONS names only the methods of the endpoint that fits the URI best.
• The CAP_NET_RAW startup warning is gone, dnsmasq reports it when it actually needs the capability.
• database.maxDBdays is an unsigned value now. A negative value kept the queries forever and is migrated to 4294967295, which continues to do so.

Fixes of note

• pi.hole and the local host name were answered with NODATA until restart once the interface cache went stale (#3050)
• An infinite loop in the dnsmasq config test when debug.config is enabled
• Webserver workers spinning at 100% CPU in the mbedTLS debug callback (#3106)
• Async-signal-safety in the real-time signal handler and the TCP worker terminator
• Query indices that went stale while the shared memory lock was released, and a domain lookup that gave up at once when a list change was being committed
• Database connection leaks and counter skew, gravity regex and search-term handling, config write races, API error paths and response correctness
• Memory-safety hardening in the netlink parsers, get_api_string(), base64_decode_update() and arp-scan

Full Changelog: pi-hole/FTL@v6.7...v6.7.1

Missing commit from previous release which is the docker-equivalent of the fix for pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww

• Move logrotate file to /etc/logrotate.d/pihole 14b661a by @yubiuser

Full Changelog: 2026.07.1...2026.07.2

What's Changed

• Restore --no-cache flag for apk by @casperklein in #2056

Full Changelog: 2026.07.0...2026.07.1

What's Changed (Docker Specific)

• Add ShellCheck CI and fix reported issues by @lightswitch05 in #2039
• Make crond and cron job output visible in "docker log" by @casperklein in #2035
• feat: optimize Docker build caching by @lightswitch05 in #2038
• remove buildkit cache mount from apk add layer by @PromoFaux in #2049

Full Changelog: 2026.04.1...2026.07.0

Security Fixes

• pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww — Local privilege escalation from pihole user to root via /etc/pihole/logrotate (High) reported by supperhellokitty20
• pi-hole/FTL/security/advisories/GHSA-q6fm-xwxf-37r5 — WebUI (& API) DoS via lack of rate limiting (High) reported by rrobgill
• pi-hole/FTL/security/advisories/GHSA-w8cr-2cwg-92cg — Session expiration bypass (High) reported by T0X1Cx
• pi-hole/FTL/security/advisories/GHSA-8j7w-m3cr-6q6x — Remote Code Execution via CivetWeb configuration injection (High) reported by SakusenSec
• pi-hole/FTL/security/advisories/GHSA-g7v8-8q8f-hprp — Log injection in the access-log writer chaining to RCE via Lua-server-page evaluation (Moderate)
• pi-hole/FTL/security/advisories/GHSA-r5vh-5q82-jg7q — CRLF injection / HTTP header injection via group name (Low) reported by T0X1Cx

What's Changed (FTL v6.7)

• Performance optimizations and bug fixes by @DL6ER in pi-hole/FTL#2816
• fix: check NULL returns from strdup/calloc in rotate_files() by @jluzzi123 in pi-hole/FTL#2875
• Make error messages more human friendly by @yubiuser in pi-hole/FTL#2878
• Harden API/database races in civetweb and DB threads by @DL6ER in pi-hole/FTL#2881
• Update embedded SQLite3 to v3.53.1 by @DL6ER in pi-hole/FTL#2891
• Fix build on Fedora 44 by @darkexplosiveqwx in pi-hole/FTL#2893
• macvendor: resolve sub-allocated blocks (MA-M/MA-S) via longest-prefix match by @RamSet in pi-hole/FTL#2907
• Update embedded dnsmasq to v2.93 by @DL6ER in pi-hole/FTL#2890
• fix OOB write in FTL_parse_pseudoheaders when optlen is 0 by @rdevshp in pi-hole/FTL#2910
• Update a single text description "PRIVATE KEY" by @DoctorD90 in pi-hole/FTL#2884
• add optional dnsmasq features to cmake by @darkexplosiveqwx in pi-hole/FTL#2874
• Fix building on alpine 3.24 by @yubiuser in pi-hole/FTL#2911
• Bats by @yubiuser in pi-hole/FTL#2872
• Improve crash backtraces for non-reproducible faults by @DL6ER in pi-hole/FTL#2880
• Fix gzip.c inflate_buffer CRC signed left shift undefined behavior by @rdevshp in pi-hole/FTL#2916
• Fix for iCloud Private Relay zones by @DL6ER in pi-hole/FTL#2919
• fix tar parsing by @rdevshp in pi-hole/FTL#2914
• Allow using local manufs to generate macvendor.db by @darkexplosiveqwx in pi-hole/FTL#2918
• Use custom message for UNIQUE constraint error message by @rdwebdesign in pi-hole/FTL#2879
• Re-resolve client groups event-driven, drop periodic recheck by @DL6ER in pi-hole/FTL#2922
• Guard against invalid gzip data in gzip.c inflate_buffer by @rdevshp in pi-hole/FTL#2915
• Fix BATS test of no ERRORS in FTL.log to allow capturing the output by @yubiuser in pi-hole/FTL#2927
• fix(cli): warn when --config cannot read pihole.toml (#2849) by @DL6ER in pi-hole/FTL#2930
• fix(api-docs): correct three OpenAPI spec issues (#2867) by @DL6ER in pi-hole/FTL#2929
• fix: avoid segfault in dnsmasq-test on unreadable config file by @DL6ER in pi-hole/FTL#2928
• Fix prefix-match bug and improve fallthrough logging in redirect_root_handler by @slmingol in pi-hole/FTL#2933
• Swap misaligned comments for domain-needed and expand-hosts. by @0xpsyduck in pi-hole/FTL#2932
• Code review July 2026 by @DL6ER in pi-hole/FTL#2935
• Pi-hole FTL v6.7 by @PromoFaux in pi-hole/FTL#2936

New Contributors

• @jluzzi123 made their first contribution in pi-hole/FTL#2875
• @RamSet made their first contribution in pi-hole/FTL#2907
• @rdevshp made their first contribution in pi-hole/FTL#2910
• @DoctorD90 made their first contribution in pi-hole/FTL#2884
• @slmingol made their first contribution in pi-hole/FTL#2933
• @0xpsyduck made their first contribution in pi-hole/FTL#2932

Full Changelog: pi-hole/FTL@v6.6.2...v6.7

What's Changed (Core v6.4.3)

• Also hardcode the PID file location in utils.sh to prevent readonly variable warning by @PromoFaux in pi-hole/pi-hole#6613
• Use awk to compare curl versions by @rdwebdesign in pi-hole/pi-hole#6621
• Explicitly add gawk to APK dependencies by @yubiuser in pi-hole/pi-hole#6622
• Prevent double error message output in gravity run with invalid file by @PromoFaux in pi-hole/pi-hole#6607
• Replace pytest/tox with direct in-container BATS by @PromoFaux in pi-hole/pi-hole#6598
• Add Fedora 44 and Ubuntu 26.04 LTS to tests by @darkexplosiveqwx in pi-hole/pi-hole#6623
• Add gravity tests by @yubiuser in pi-hole/pi-hole#6639
• Set BATS pretty output flag depending on the terminal and improve failure output by @yubiuser in pi-hole/pi-hole#6644
• fix: check return codes in gravity_build_tree and database_recovery() by @jluzzi123 in pi-hole/pi-hole#6630
• Include alpine 3.24 in tests by @yubiuser in pi-hole/pi-hole#6654
• installer: fix custom DNS entry when only one upstream server is provided by @Gilmoursa in pi-hole/pi-hole#6638
• Fix BATS gravity test on curl version >=8.21 by @yubiuser in pi-hole/pi-hole#6661
• avoid copytruncate in logrotate by @darkexplosiveqwx in pi-hole/pi-hole#6642

New Contributors

• @jluzzi123 made their first contribution in pi-hole/pi-hole#6630
• @Gilmoursa made their first contribution in pi-hole/pi-hole#6638

Full Changelog: pi-hole/pi-hole@v6.4.2...v6.4.3

What's Changed (Web v6.6)

• Improve DHCP static leases interface (alternative) by @rdwebdesign in pi-hole/web#3766
• Lists page - Improve hints and help text by @rdwebdesign in pi-hole/web#3798
• Update daterangepicker ranges everytime the picker is shown by @yubiuser in pi-hole/web#3793
• Better user interface to edit reverse DNS servers (dns.revServers) by @rdwebdesign in pi-hole/web#3769

Full Changelog: pi-hole/web@v6.5.1...v6.6

What's Changed (Docker Specific)

• docs: update capability documentation links by @SirRGB in #2025

New Contributors

• @SirRGB made their first contribution in #2025

Full Changelog: 2026.04.0...2026.06.0

What's Changed (Web 6.5.1)

• Fix backed-up typo by @yubiuser in pi-hole/web#3759
• fix: replace ES2024 regex v flag with u for WebKit compatibility by @Gilmoursa in pi-hole/web#3778
• bug: multiline comments on doughnut chart by @vinaykulk621 in pi-hole/web#3781

New Contributors

• @Gilmoursa made their first contribution in pi-hole/web#3778
• @vinaykulk621 made their first contribution in pi-hole/web#3781

Full Changelog: pi-hole/web@v6.5...v6.5.1

This tag includes the FTL v6.6.2 release which imports six upstream dnsmasq security fixes, covering all publicly disclosed CVEs against the dnsmasq 2.92/2.93 line. Patches are taken verbatim from https://thekelleys.org.uk/dnsmasq/CVE/

Details here: https://github.com/pi-hole/FTL/releases/tag/v6.6.2

Upgrade impact

All six fixes are minimal, self-contained changes to the embedded dnsmasq sources. No FTL-side configuration or API changes; users should see no observable behavior change beyond the closed vulnerabilities.

Fix dnsmasq CVE publications by @DL6ER in pi-hole/FTL#2888

This furthermore indirectly fixes #2871 due to pi-hole/docker-base-images#158

Full Changelog: pi-hole/FTL@v6.6.1...v6.6.2

What's Changed (Docker Specific)

• docs: update capability documentation links by @SirRGB in #2025

New Contributors

• @SirRGB made their first contribution in #2025

Full Changelog: 2026.04.0...2026.05.0

What's Changed

• docs: update capability documentation links by @SirRGB in #2025

New Contributors

• @SirRGB made their first contribution in #2025

Full Changelog: 2026.04.0...2026.04.1

New component versions included in this tag:

What's Changed (FTL v6.6.1)

• Add new GET /api/config/_properties endpoint by @DL6ER in pi-hole/FTL#2356
• Fix thread-safety issues causing SIGSEGV under concurrent API load by @DL6ER in pi-hole/FTL#2835
• fix: fix rare race condition for SHM strings in API handlers by @DL6ER in pi-hole/FTL#2833
• Accept punycode domains that libidn2 rejects under IDNA2008 by @DL6ER in pi-hole/FTL#2838
• Improve shutdown diagnostics to identify SIGTERM source by @DL6ER in pi-hole/FTL#2839
• Resolve empty backtraces when addr2line is not installed by @DL6ER in pi-hole/FTL#2831
• Improve thread-safety for concurrent API requests by @DL6ER in pi-hole/FTL#2847
• Don't skip device lookup when resolver.macNames is disabled by @DL6ER in pi-hole/FTL#2846
• Fix linker error when compiling w/o optimization by @aeolio in pi-hole/FTL#2850
• Clarify dns.blockESNI wording by @darkexplosiveqwx in pi-hole/FTL#2784
• Preserve log file path config when fopen fails by @DL6ER in pi-hole/FTL#2834

Security advisories

• GHSA-6w8x-p785-6pm4
  • Fixed with : pi-hole/FTL@88c569a and pi-hole/pi-hole@7ccb8dd
• GHSA-9cqv-839p-gpq2
  • Fixed with : pi-hole/FTL@0c46e4e

New Contributors

• @darkexplosiveqwx made their first contribution in pi-hole/FTL#2784

Full Changelog: pi-hole/FTL@v6.6...v6.6.1

What's Changed (Core v6.4.2)

• Wipe version file before creating a new one by @yubiuser in pi-hole/pi-hole#6538
• Fix ownership permissions for containing directories in fix_owner_per… by @PromoFaux in pi-hole/pi-hole#6589
• Remove reference to /usr/local/bin/COL_TABLE by @darkexplosiveqwx in pi-hole/pi-hole#6594
• Skip apt cache update when pihole-meta is current by @PromoFaux in pi-hole/pi-hole#6581
• Set versions in /etc/pihole/versions to null if script fails by @yubiuser in pi-hole/pi-hole#6550
• Remove redundant touching of logfiles from systemd Service by @yubiuser in pi-hole/pi-hole#6601
• Loosen requirements for local file access for gravity by @yubiuser in pi-hole/pi-hole#6430
• Fix permission for *.etag files after gravity run by @yubiuser in pi-hole/pi-hole#6353
• add logrotate to DEB and RPM dependencies by @darkexplosiveqwx in pi-hole/pi-hole#6524
• Improve gravity error message including curl exit code and errormsg by @rdwebdesign in pi-hole/pi-hole#6605

Security advisories

• GHSA-6w8x-p785-6pm4
  • Fixed with : pi-hole/pi-hole@7ccb8dd and pi-hole/FTL@88c569a

Full Changelog: pi-hole/pi-hole@v6.4.1...v6.4.2

What's Changed (Docker Specific - all related to CI/build)

• Group dependabot PRs to reduce PR spam by @yubiuser in #2004
• ci: switch image publishing to docker/github-builder by @crazy-max in #2008
• Readme Rework by @PromoFaux in #1958
• Replace Python test suite with BATS and consolidate workflows by @PromoFaux in #2009
• Add timeout to curl command in branch validation by @RynoCODE in #2011
• Use bats-assert library functions in BATS test suite by @Copilot in #2018
• ci: run build job on pull request event by @crazy-max in #2021
• Update github-builder to v1.5.0 and enable fail-fast by @yubiuser in #2022

New Contributors

• @crazy-max made their first contribution in #2008
• @RynoCODE made their first contribution in #2011
• @Copilot made their first contribution in #2018

Full Changelog: 2026.02.0...2026.04.0

Component Release Notes

What's Changed (FTL v6.6)

• Fix possible resolver issue on armv5tel by @DL6ER in pi-hole/FTL#2781
• Introduce CMake options for optional dependencies by @aeolio in pi-hole/FTL#2795
• Fix build without mbedtls [v2] by @aeolio in pi-hole/FTL#2796
• Fix overTime data when database.DBimport = false by @DL6ER in pi-hole/FTL#2788
• Fix cross-compilation issues w/ custom toolchain by @aeolio in pi-hole/FTL#2797
• Add new option for controling name resolution via MAC address by @DL6ER in pi-hole/FTL#2790
• Fix obtaining client groups by name by @DL6ER in pi-hole/FTL#2791
• Ensure API sessions are restored before starting the HTTP server by @DL6ER in pi-hole/FTL#2803
• Add form-action 'self' to Content-Security-Policy by @yubiuser in pi-hole/FTL#2804
• Add query_frequency to /padd endpoint by @yubiuser in pi-hole/FTL#2806
• Guard query-count counters against unsigned underflow by @DL6ER in pi-hole/FTL#2815
• Add universal crash backtrace via _Unwind_Backtrace by @DL6ER in pi-hole/FTL#2811
• config: show totp_secret presence in CLI output by @DL6ER in pi-hole/FTL#2813
• Fix client count inflation for rate-limited queries by @DL6ER in pi-hole/FTL#2814
• Fix stack buffer overflow in get_process_name() by @DL6ER in pi-hole/FTL#2821
• Do not restart FTL while pihole -g is still ongoing by @DL6ER in pi-hole/FTL#2419

Security Advisories

• GHSA-r7g8-3fj7-m5qq - Authorization bypass: CLI API sessions can import Teleporter archives and modify configuration reported by @mzalzahrani
• Remote Code Execution (RCE) via Newline Injection in Multiple Configuration Parameters reported by @T0X1Cx
  • pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c
  • pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp
  • pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m
  • pi-hole/FTL/security/advisories/GHSA-fqv2-qhfh-ghcj
  • pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj

New Contributors

• @aeolio made their first contribution in pi-hole/FTL#2795

Full Changelog: pi-hole/FTL@v6.5...v6.6

What's Changed (Web v6.5)

• Amend teleporter help text that the long-term data is not included by @yubiuser in pi-hole/web#3721
• Do not use 3 columns when boxed layout is used by @rdwebdesign in pi-hole/web#3722
• Use ENTER instead of ⏎ by @yubiuser in pi-hole/web#3727
• Don't link to github releases if docker tag is nightly by @yubiuser in pi-hole/web#3718
• Do not try to compare component version when remote version info is not available by @yubiuser in pi-hole/web#3729
• Show loading overlay when adding/removing CNAME records as it requires a FTL restart by @yubiuser in pi-hole/web#3742
• fix: check on responseJSON when wrong password by @guybrush2105 in pi-hole/web#3693
• Remove the loggingButton from Settings > System > Actions by @yubiuser in pi-hole/web#3747

Security Advisories

• Multiple Stored HTML Injections and XSS in different web interface pages reported by @andrejtomci

  • GHSA-jx8x-mj2r-62vq - Stored HTML Injection in queries.js

  • GHSA-9rfm-c5g6-538p - Stored HTML attribute injection

  • GHSA-px6w-85wp-ww9v - Stored XSS / HTML injection in the Network page/Dashboard

  • GHSA-7xqw-r9pr-qv59 - Reflected XSS / HTML injection in taillog.js (Also reported by @n1rwhex and @mzalzahrani)

New Contributors

• @guybrush2105 made their first contribution in pi-hole/web#3693

Full Changelog: pi-hole/web@v6.4.1...v6.5

What's Changed (Core v6.4.1)

• Remove additional ':' from debug log system time output by @yubiuser in pi-hole/pi-hole#6551
• Remove readonly from piholeNetworkFlush.sh to avoid error message by @rdwebdesign in pi-hole/pi-hole#6554
• Add antigravity index by @DL6ER in pi-hole/pi-hole#6573
• Fix return status capture of FTL check_download exists by @yubiuser in pi-hole/pi-hole#6572
• Remove misleading TODO comment for SetWebPassword by @10adnan75 in pi-hole/pi-hole#6531

Security Advisories

• GHSA-c935-8g63-qp74 – Local Privilege Escalation reported by @smittix

New Contributors

• @10adnan75 made their first contribution in pi-hole/pi-hole#6531
• @Copilot made their first contribution in pi-hole/pi-hole#6580

Full Changelog: pi-hole/pi-hole@v6.4...v6.4.1