{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44693", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T17:07:09.315Z", "datePublished": "2026-06-10T22:11:29.237Z", "dateUpdated": "2026-06-12T03:55:28.698Z"}, "containers": {"cna": {"title": "Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7"}, {"name": "https://github.com/pi-hole/FTL/releases/tag/v6.6.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/pi-hole/FTL/releases/tag/v6.6.1"}], "affected": [{"vendor": "pi-hole", "product": "FTL", "versions": [{"version": "< 6.6.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T22:11:29.237Z"}, "descriptions": [{"lang": "en", "value": "Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1."}], "source": {"advisory": "GHSA-9ff5-f3v5-2xc7", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-44693"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T03:55:28.698Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44693", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T15:46:10.512843Z"}}}], "references": [{"url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T15:48:14.480Z"}}], "cna": {"title": "Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer", "source": {"advisory": "GHSA-9ff5-f3v5-2xc7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pi-hole", "product": "FTL", "versions": [{"status": "affected", "version": "< 6.6.1"}]}], "references": [{"url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7", "name": "https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pi-hole/FTL/releases/tag/v6.6.1", "name": "https://github.com/pi-hole/FTL/releases/tag/v6.6.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T22:11:29.237Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44693", "state": "PUBLISHED", "dateUpdated": "2026-06-12T03:55:28.698Z", "dateReserved": "2026-05-07T17:07:09.315Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-10T22:11:29.237Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FTL", "vendor": "pi-hole", "versions": [{"status": "affected", "version": "< 6.6.1"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1."}, {"lang": "es", "value": "Pi-hole FTL es el motor principal del bloqueador de anuncios y rastreadores a nivel de red de Pi-hole. Antes de la versi\u00f3n 6.6.1, Pi-hole FTL contiene una vulnerabilidad de condici\u00f3n de carrera en el subsistema de gesti\u00f3n de sesiones HTTP, introducida con la reescritura v6.0 del servidor web embebido basado en CivetWeb. Este problema ha sido parcheado en la versi\u00f3n 6.6.1."}], "id": "CVE-2026-44693", "lastModified": "2026-07-23T09:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44693", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-06-10T23:16:46.690", "references": [{"source": "[email protected]", "url": "https://github.com/pi-hole/FTL/releases/tag/v6.6.1"}, {"source": "[email protected]", "url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "[email protected]", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "ftl", "vendor": "pi-hole"}], "created": "2026-06-10T23:30:44.129274+00:00", "updated": "2026-06-11T10:40:37.446389+00:00", "vendors": ["pi-hole", "pi-hole$PRODUCT$ftl"]}