CVE-2026-44693

Deferred Deferred - Pending Action

Race Condition in Pi-hole FTL HTTP Session Management

Publication date: 2026-06-10

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-11

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-44693

Affected Vendors & Products

Vendor	Product	Version / Range
pi-hole	ftl	to 6.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

The vulnerability in Pi-hole FTL is a race condition in the HTTP session management subsystem. It exists in versions prior to 6.6.1 and was introduced with the version 6.0 rewrite of the embedded CivetWeb-based web server. This race condition could allow unintended behavior during HTTP session handling.

Impact Analysis

This vulnerability has a high severity with a CVSS base score of 8.8, indicating it can have a significant impact. It can lead to high confidentiality, integrity, and availability impacts, meaning an attacker could potentially access sensitive data, alter data, or disrupt service availability through exploiting the race condition in the HTTP session management.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Pi-hole FTL to version 6.6.1 or later, where the race condition in the HTTP session management subsystem has been patched.

Compliance Impact

The vulnerability allows unauthenticated attackers on the local network to hijack administrator sessions, granting full administrative access to DNS settings, ad blocking, and network data. This unauthorized access to sensitive network data and administrative controls could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

By enabling attackers to gain administrative control without credentials, the vulnerability undermines the confidentiality and integrity of network data, potentially exposing personal data and violating compliance requirements for secure access and data protection.

Hi! I’m here to help you understand CVE-2026-44693. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70