Pi-hole

Loading content

Network-wide ad blocking via your own Linux hardware The Pi-hole is a DNS sinkhole that protects your devices from unwanted content, without installing any client-side software. Easy-to-install: our versatile installer walks you through the process, and takes less than ten minutes Resolute: content is blocked in non-browser locations, such as ad-laden mobile apps and smart TVs Responsive: seamlessly speeds up the feel of everyday browsing by caching DNS queries Lightweight: runs smoothly with minimal hardware and software requirements Robust: a command line interface that is quality assured for interoperability Insightful: a beautiful responsive Web Interface dashboard to view and control your Pi-hole Versatile: can optionally function as a DHCP server, ensuring all your devices are protected automatically Scalable: capable of handling hundreds of millions of queries when installed on server-grade hardware Modern: blocks ads over both IPv4 and IPv6 Free: open source software which helps ensure you are the sole person in control of your privacy One-Step Automated Install Those who want to get started quickly and conveniently, may install Pi-hole using the following command: curl -sSL https://install.pi-hole.net | bash Alternative Install Methods Piping to bash is controversial, as it prevents you from reading code that is about to run on your system. Therefore, we provide these alternative installation methods which allow code review before installation: Method 1: Clone our repository and run git clone --depth 1 https://github.com/pi-hole/pi-hole.git Pi-hole cd "Pi-hole/automated install/" sudo bash basic-install.sh Method 2: Manually download the installer and run wget -O basic-install.sh https://install.pi-hole.net sudo bash basic-install.sh

Get more from Pi-hole

Access exclusive benefits starting at $1/month

Gift

Latest post

We've just pushed out a new version of FTL and the docker images that address a number of dnsmasq CVEs that were published today. https://github.com/pi-hole/FTL/releases/tag/v6.6.2 All six fixes are minimal, self-contained changes to the embedded dnsmasq sources. No FTL-side configuration or API changes; users should see no observable behavior change beyond the closed vulnerabilities. CVEs fixed CVE-2026-2291 — Heap OOB write in struct bigname. The on-heap namebuffer was sized for the wire form of a domain name (MAXDNAME) rather than its escaped internal form (MAXDNAME*2 + 1). A remote peer that can send or answer DNS queries could cause a large out-of-bounds write on the heap. Reported by Andrew S. Fasano. CVE-2026-4890 — DNSSEC denial of service via NSEC bitmap parsing.The window-iteration step omitted the 2-byte window header, so a crafted NSEC record with bitmap_length == 0 produced an infinite loop and dnsmasq stopped answering queries. Reachable before RRSIG validation,so no valid signatures are required to trigger it. Reported by Royce M. CVE-2026-4891 — DNSSEC crash via crafted RRSIG. A packet declaring an rdlen smaller than the fixed RRSIG header plus signer's name produced a negative signature length and a subsequent crash. Reported by Royce M. CVE-2026-4892 — Privileged buffer overflow in the DHCP helper.When --dhcp-script is configured, hex-encoded DHCPv6 client identifiers (up to 65535 bytes) were written into a 5131-byte buffer in the root-privileged helper. Reported by Royce M. CVE-2026-4893 — EDNS Client Subnet validation bypass. With--add-subnet enabled, process_reply() passed the OPT record length(~23 bytes) to check_source() instead of the packet length, causing every internal bounds check to fail and the validation routine to always return success. ECS source validation per RFC 7871 §9.2 was effectively disabled. Reported by Royce M. CVE-2026-5172 — Heap OOB read in extract_addresses(). A mismatched RR rdlen allowed extract_name() to advance past the computed end of the record, underflowing the remaining-bytes calculation and producing a large OOB read with certain crash.Reported by Hugo Martinez Ray.

FTL v6.6.2 - dnsmasq security update

We've just pushed out a new version of FTL and the docker images that address a number of dnsmasq CVEs that were published today. https://gi

May 11

FTL v6.6.2 - dnsmasq security update

We've just pushed out a new version of FTL and the docker images that address a number of dnsmasq CVEs that were published today. https://gi

May 11

Loading content