Software-update: Pi-hole Core 6.5 / Web 6.6.1 / FTL 6.8

Versie 6.5 van Pi-hole Core is uitgekomen. Ook zijn Pi-hole Web 6.6.1 en Pi-hole FTL 6.8 verschenen. Pi-hole is een advertising-aware dns- en webserver bedoeld om te draaien op een Raspberry Pi in het netwerk. Als op de router naar Pi-hole wordt verwezen voor dns-afhandelingen, zullen alle apparaten binnen het netwerk er automatisch gebruik van maken zonder dat er instellingen hoeven te worden aangepast. Vervolgens worden advertenties niet meer opgehaald, waardoor pagina's sneller laden. In potentie kan er ook malware mee buiten de deur worden gehouden. Voor meer informatie verwijzen we jullie door naar de uitleg en video's op deze pagina, deze handleiding van tweaker jpgview, of dit topic op ons forum. De releasenotes voor deze uitgave kunnen hieronder worden gevonden.

Pi-hole FTL v6.8, Web v6.6.1 and Core v6.5 released

This release fixes a number of security advisories across FTL, Web and Core. Thank you to everyone who reported them. Before updating, please read the changelogs below. Update with pihole -up. If you want a safety net, take a backup of your configuration first with Teleporter (Settings -> Teleporter in the web interface, or pihole-FTL --teleporter).

The Docker image is tagged 2026.10.0.

Security fixes

High

• Core: command execution via a crafted PID (GHSA-cf36-4hhc-8398, CVSS 7.8): getFTLPID() now only accepts a PID naming a running pihole-FTL, and logrotate uses it.
• Core: root writing to config-supplied paths (GHSA-mff6-cjc4-5wq9, CVSS 7.3): gravity.sh re-executes as pihole, and the log flush writes as pihole.
• Core: root following a symlink when writing the version file (GHSA-xcb-4qxw-g5vj, CVSS 7.8): the update checker and FTL prestart script no longer create or chmod files in the pihole-owned /etc/pihole as root.
• Core: /opt/pihole hardening (GHSA-j8vh-6fp9-cjcx, CVSS 7.8): read-only for the FTL service.
• FTL: document root relocation via Teleporter import / symlink (GHSA-2h7g-g549-hf74, CVSS 7.7): an authenticated session could move the document root to / and, with webserver.serve_all, serve files unauthenticated.

Medium

• FTL: local file contents echoed when parsing a file:// adlist (GHSA-667h-gpmh-7gxc, CVSS 6.5): an authenticated user could read files the pihole user can open. Needs the matching Core change (#6706).
• FTL: app sessions could read password hashes and the TOTP secret (GHSA-v53r-4564-3449, CVSS 6.5; duplicate GHSA-846w-3j3v-2hx8): read-only app sessions could read both via /api/config and /api/teleporter.
• FTL: out-of-bounds write in the API TXT buffer (GHSA-8fc6-q9x4-892v, CVSS 5.9): needs a long upstream server list, no authentication.
• FTL: EDNS(0) data leaking between clients’ queries (GHSA-xj4x-gf2g-r6m7, CVSS 4.2): data from one packet could be applied to another client’s query.

Low

• Core: file:// adlist read check and curl could resolve different files (GHSA-g63w-24cr-p3w6, CVSS 2.2): a bypass of the read check that the FTL file:// fix relies on, needing an admin who can add adlists plus a symlink and decoy on the filesystem. Local lists are now read with cat as the user whose access was checked.
• FTL: cross-site requests and DNS rebinding against a passwordless install (GHSA-322h-f873-hp54): with no password set, any website opened on the network could reach the API through the visitor’s browser. FTL now refuses cross-site browser requests and unrecognised Host names when no password is set.
• FTL: race when deleting a DHCP lease (GHSA-v8mj-cqgw-63rj, CVSS 2.2): needs an authenticated client and the DHCP server enabled.
• FTL: crash when searching domains during a list reload (GHSA-9828-2f2q-2c8v, CVSS 2.2): needs a valid session.
• FTL: crash on a malformed POSTed regex array (GHSA-mqr7-j2p5-5495, CVSS 2.7): needs a valid session.
• Web: stored XSS on three settings pages (GHSA-rmr4-hqc8-825f, GHSA-3vhj-5284-xrmm, GHSA-qfpp-28mj-pj6p, CVSS 3.5 / 3.1 / 3.1): Settings > All settings, Local DNS Records and DNS.

FTL v6.8

This is a minor release rather than v6.7.2: there are enough visible behaviour changes that a patch version would undersell it. It backports the bug fixes that landed on development since v6.7.1 and updates the embedded dnsmasq (v2.93+30) and SQLite (v3.53.3).

Improvements

• The live log is now stored as a ring buffer instead of moving the whole buffer for every new line, which costs far less CPU per cached answer.
• Internationalised domain names on lists are converted to punycode with libidn2 and block, instead of being rejected as invalid.
• Long-term statistics are grouped before joining the name tables (faster), and two unused in-memory indexes are gone, saving about 22 MB per million queries.

Notable fixes

• Flushing the logs deleted the whole long-term history, not only the last 24 hours, and moved the graph a day into the future.
• Crashes with 257+ alias-clients, with a no-longer-forced FTLCONF_ array, and with database.DBinterval = 0.
• Group and list changes not reaching a client until the next reload, stale forced replies, and missing EDE on the first block.
• A file path containing + (or any other printable ASCII) was reset to its default on start-up.
• An open redirect in the .lp compatibility redirect, and / ignoring webserver.serve_all.
• Pi-hole’s own certificate for a custom webserver.domain was never renewed, and a domain longer than 64 characters ended up as an oversized CN.
• The empty-DS DNSSEC loop, via dnsmasq, plus its double-free and information disclosure fixes.
• An API session could enable misc.readOnly through a Teleporter archive, and pihole.toml.lock failed on NFS.
• Any LAN client could make FTL add a new PTR record for every spelling of its own address until a restart.
• The CLI password file and pihole-tmp.db were briefly or permanently readable by everyone.
• On ARM and RISC-V the MAC address of a new device was never looked up at query time, so its MAC-based groups only applied later.
• Raising misc.privacylevel at runtime did not cover domains and clients already seen, and an ntp.sync.interval above about 24.8 days made the NTP client sync back to back.
• DNS stalls on list reloads and rate limiting, GC double processing, lost queries at shutdown, and wrong long-term statistics.
• Old queries were never deleted from pihole-FTL.db on a host that restarts FTL at least once a day.
• dhcp-discover printed the DNSSL labels of Router Advertisements unescaped.
• Clients without a MAC address (e.g. a WireGuard peer) stayed in the default group until the next list reload, because the groups of a new client were resolved before its interface was known.
• The load check counted only the CPUs a container was limited to, while /proc/loadavg shows the host’s load, so the long-term load warning fired spuriously and /api/info/system inflated the load percentage in LXC/Docker with fewer cores. FTL now counts all present host CPUs.
• Assorted API fixes: CORS headers on 204 and error responses, the reply shape of /api/queries at privacy level 3, /api/history/clients at every privacy level, 64-bit swap figures in /api/info/system, and a rejected POST /api/teleporter upload whose import field does not parse.
• FTLCONF_files_log_ftl was not used for log lines on early startup.

Behaviour changes to be aware of

• Invalid values found in pihole.toml are rejected and reset to the default: database.DBinterval of 0, a webserver.tls.cert below the webroot, a non-base32 webserver.api.totp_secret, relative paths for files FTL writes, and a files.tmp_db that names another file Pi-hole keeps (e.g. pihole-FTL.db). A webserver.api.maxHistory above 86400 is reduced to 86400. A list (e.g. dns.hosts) now loses only its invalid entries instead of being reset as a whole.
• With webserver.serve_all = false, / under a host other than webserver.domain now returns a 404, so a custom index.html in the webroot no longer shows up at http://<ip>/. Behind a proxy that does not strip webserver.paths.prefix, the prefixed path returns a 404 as well.
• A renewed self-signed certificate comes with a new CA, so an imported tls_ca.crt has to be imported again.
• FTL no longer hands a symbolic link (e.g. pihole-FTL.db or FTL.log linked to another disk) to the pihole user, and warns about it on every start. Such a target has to be owned by pihole already.
• When FTL runs as root it only changes ownership or permissions of regular files directly in /etc/pihole and /var/log/pihole, and refuses a symbolic link as log file (including files.log.dnsmasq). Started as pihole, a linked log file keeps working.
• A blocking timer on an unchanged status now switches to the opposite mode when it expires.
• The host’s own interfaces show up in the network table, and shutdown may wait up to 30 seconds for a busy database thread.
• dnsmasq adds the option4: syntax and DHCPv6 vendor classes.
• Changing ntp.sync.interval restarts FTL, ntp.sync.count = 0 is rejected, and POST /api/action/gravity answers 409 while a run is in progress.
• Queries older than database.maxDBdays are deleted in the first night after a start, 10000 at a time. A database that kept growing will lose its whole backlog in the first night after the update.
• A v5 Teleporter import replaces the upstreams, reverse servers and excluded domains/clients instead of adding to them.

Web v6.6.1

A patch release for the stable line while development is mid-rework (AdminLTE 4 / Bootstrap 5).

• Query Log: show the actual API error (e.g. “The item is already present”) instead of a generic network error.
• Conditional Forwarding: reject CIDR and otherwise invalid server IPs.
• Static DHCP leases: fix the tag: validation regex and allow internal underscores in hostnames.
• hexEncode() now handles code points above U+FFFF.
• Login no longer blames the password for a refusal that is not about it.
• Query Log: the API URL is no longer encoded twice.
• Bundled Moment.js bumped to 2.31.0.
• DNS settings: clearer “local requests” wording, and an emptyTable typo fixed.

Core v6.5

• Stop double-rotating logs now that pihole is in /etc/logrotate.d.
• Remove the deprecated arpflush command in favour of networkflush.
• Improve gravity error handling.
• Fix unquoted variable expansion in rm paths.
• Send USR2 after logrotate.
• Keep /etc/pihole/versions readable by all users.
• Remove Debian 11 from the CI distro matrix.
• Fix URL parsing in gravity.sh.
• Improve the gravity database schema for performance: WITHOUT ROWID junction tables, new indexes for group lookups and cheaper triggers. Existing databases are migrated to schema version 21 on update.
• Store the listsCache directory next to gravity.db instead of always in /etc/pihole.
• Run the update checker and the FTL prestart file fix-ups as the pihole user, and only trust git repositories the pihole user cannot modify.
• Read local file:// adlists as the user whose access was checked, instead of via curl.
• Parse local file:// adlist URIs with parameter expansion and path canonicalisation (RFC 8089)
• Pass the adlist source URL to FTL’s parseList (needed by the FTL v6.8 file:// adlist fix).
• Flush the last 24 hours of queries through the FTL API instead of touching the database directly.
• Stop granting CAP_CHOWN to everything pihole-FTL executes (kept in the ambient set of the FTL service).

Versienummer	6.5 / 6.6.1 / 6.8
Releasestatus	Final
Besturingssystemen	Scripttaal
Website	Pi-hole
Download	https://github.com/pi-hole/pi-hole/#one-step-automated-install
Licentietype	GPL

Reacties (9)

[jompie]

Nog tips voor goede blocklists?

Ik gebruik zelf deze:

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

https://big.oisd.nl/

https://urlhaus.abuse.ch/downloads/hostfile/

https://phishing.army/download/phishing_army_blocklist_extended.txt

[En-Cryption]

Je kan die van AdGuard Home eventueel toevoegen.

https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt

[Reactie gewijzigd door En-Cryption op 17 oktober 2026 20:23]

[lenwar]

Ik gebruik alleen die van OISD.

Ik heb niet het idee dat er in de praktijk veel doorheen komt.

[Erulezz]

Blocklists van HaGeZi zijn erg goed en veelgebruikt;

https://github.com/hagezi/dns-blocklists

Veel opties en mogelijkheden dus even goed doorlezen welke je wil.

[saken]

Wat maakt PiHole beter dan AdGuard?

[lenwar]

Volgens mij is het in z’n totaal wat lichter. Maar AGH heeft native DoH-ondersteuning (aan de voorkant en achterkant)

Het is dus net wat je belangrijk vindt.

Ik gebruik zelf Technitium. Dat is een wat completere DNS-server waar je met gedetailleerd low level zaken in kunt regelen, maar als je dat niet nodig hebt, heb je er niets aan.

[Toet3r]

Komt in pi-hole ook :) Versie 7 die nog in ontwikkeling is heeft native DoH en DoT.
Heb de nightly docker container al geprobeerd met DoT en dat werkte prima.

[Get!em]

Pihole zelf misschien niet direct, maar je kunt pihole in container (bijv Proxmox) samen met Unbound installeren.

Je krijgt dan je eigen upstream recursive dns server, zodat je niet de grote upstreams van Google , cloudflare etc gebruikt.

[AvWijk]

Ik gebruik zelf AdGuard Home en dat bevalt zover even goed. Niet vergeten je upstream DNS in te stellen, dat verhelpt veel vage timeout problemen. Zowel AG Home als Pi-hole draaien op een aardappel (heb er nog wel een stuk of wat van te koop, ready to go geinstalleerd met NixOS en Adguard)