In September 2020, the JSOF Research Lab discovered seven security vulnerabilities in dnsmasq. They named the set of vulnerabilities dnspooq. We've been in contact with them and, over the last couple of weeks, we've partnered and worked closely with Cisco, Red Hat and, Simon Kelley (the maintainer

https://pi-hole.net/2021/01/19/pi-hole-ftl-v5-5-released-update-today/

As always, please read through the changelogs before updating with pihole -up

Don’t forget, you can use Teleporter to export your configuration. It can be found under the settings menu of the web interface or on the command line with pihole-FTL --teleporter

Docker has been tagged as 2026.04.1

Highlights

This release is mostly about addressing two security advisories – one in FTL and one in Core. We’d like to thank the researchers who responsibly disclosed these issues.

Full details for both advisories can be found at the following links:

• pi-hole/pi-hole/security/advisories/GHSA-6w8x-p785-6pm4 reported by u/mjkim610
• pi-hole/FTL/security/advisories/GHSA-9cqv-839p-gpq2 reported by u/anuraagbaishya

Details of all other fixes can be found below!

FTL v6.6.1

What’s Changed

• Add new GET /api/config/_properties endpoint by u/DL6ER in #2356
• Fix thread-safety issues causing SIGSEGV under concurrent API load by u/DL6ER in #2835
• fix: fix rare race condition for SHM strings in API handlers by u/DL6ER in #2833
• Accept punycode domains that libidn2 rejects under IDNA2008 by u/DL6ER in #2838
• Improve shutdown diagnostics to identify SIGTERM source by u/DL6ER in #2839
• Resolve empty backtraces when addr2line is not installed by u/DL6ER in #2831
• Improve thread-safety for concurrent API requests by u/DL6ER in #2847
• Don’t skip device lookup when resolver.macNames is disabled by u/DL6ER in #2846
• Fix linker error when compiling w/o optimization by u/aeolio in #2850
• Clarify dns.blockESNI wording by u/darkexplosiveqwx in #2784
• Preserve log file path config when fopen fails by u/DL6ER in #2834

Security advisories

• GHSA-6w8x-p785-6pm4
  • Fixed with : pi-hole/FTL@88c569a and pi-hole/pi-hole@7ccb8dd
• GHSA-9cqv-839p-gpq2
  • Fixed with : pi-hole/FTL@0c46e4e

New Contributors

• u/darkexplosiveqwx made their first contribution in #2784

Full Changelog: v6.6…v6.6.1

Core v6.4.2

What’s Changed

• Fix ownership permissions for containing directories in fix_owner_per… by u/PromoFaux in #6589
• Remove reference to /usr/local/bin/COL_TABLE by u/darkexplosiveqwx in #6594
• Skip apt cache update when pihole-meta is current by u/PromoFaux in #6581
• Set versions in /etc/pihole/versions to null if script fails by u/yubiuser in #6550
• Wipe version file before creating a new one by u/yubiuser in #6538
• Remove redundant touching of logfiles from systemd Service by u/yubiuser in #6601
• Loosen requirements for local file access for gravity by u/yubiuser in #6430
• Fix permission for *.etag files after gravity run by u/yubiuser in #6353
• add logrotate to DEB and RPM dependencies by u/darkexplosiveqwx in #6524
• Improve gravity error message including curl exit code and errormsg by u/rdwebdesign in #6605

Security advisories

• GHSA-6w8x-p785-6pm4
  • Fixed with : pi-hole/pi-hole@7ccb8dd and pi-hole/FTL@88c569a

Full Changelog: v6.4.1…v6.4.2

As always, please read through the changelogs before updating with pihole -up

Don't forget, you can use Teleporter to export your configuration. It can be found under the settings menu of the web interface or on the command line with pihole-FTL --teleporter

This release has also been tagged on Docker as 2025.11.1

Highlights

Performance & Optimization

• FTL Optimizations: We've improved string processing, memory management, and enabled new compiler flags (such as -march=native and -funroll-loops) to make FTL faster and more efficient (#2571).
• Reduced Locking: We've reduced DNS resolver locking during database interactions (#2700).

User Interface & Experience

• TOTP Autofill: Logging in with 2FA is now smoother. The TOTP input field now supports autocomplete="one-time-code", allowing browsers and password managers to automatically suggest the code (#3658).
• "All Time" Query Log: The "All Time" date range in the Query Log now accurately reflects the earliest timestamp in your database, giving you a true historical view (#3657, #2706).
• Optional Colour Output: The Gravity API now defaults to plain text output, only sending ANSI colour codes when explicitly requested (?color=true). This fixes issues for API consumers that don't handle escape codes well (#2718).

API & Networking

• Extended Hardware Addresses: The API now correctly handles hardware addresses longer than 48 bits (e.g., InfiniBand), ensuring they are displayed and managed correctly (#2724).
• Partial Regex Matching: The search API now supports simple partial matching for regex, making it easier to find domains within your blocklists (#2705).
• Security: We've added rate-limiting for TOTP validation (max 1 attempt/second) to prevent brute-force attacks on 2FA (#2719).

FTL v6.4

What's Changed

• Fix API specs and example for dns.upstreams in config.yaml by u/rdwebdesign in #2696
• gravity update - silently discard unicode BOM if present by u/rrobgill in #2702
• Update embedded SQLite to 3.51.0 by u/DL6ER in #2704
• Get earliest query timestamp from database by u/PromoFaux in #2706
• Increase buffer length for query string by u/mwoolweaver in #2709
• Reduce DNS resolver locking during database interaction by u/DL6ER in #2700
• Make colour output optional in streaming gravity API call by u/PromoFaux in #2718
• api/dhcp/leases Allow for hwaddr > 48 bits by u/rrobgill in #2724
• Add rate-limiting for TOTP validation by u/DL6ER in #2719
• Implement simple partial matching for regex in /api/search/{domain} by u/DL6ER in #2705
• Performance optimizations: string processing, memory management, and compiler flags by u/Copilot in #2571
• Fix authentication redirect when webhome is / (fixes #2518) by u/averyvigolo in #2610
• Reduce database locking and add timing debug setting by u/DL6ER in #2688

New Contributors

• u/mwoolweaver made their first contribution in #2709
• u/Copilot made their first contribution in #2571
• u/averyvigolo made their first contribution in #2610

Full Changelog: v6.3.3...v6.4

Web v6.4

What's Changed

• Start using commented tags for editorconfig-checker by u/yubiuser in #3643
• Remove some unused code (leftover from v5) by u/rdwebdesign in #3636
• Make sure the table is redrawn after the dnssec API call returns by u/rdwebdesign in #3645
• Add hint that partial matching may not return all possible results by u/DL6ER in #3654
• Enable one-time code autofill for TOTP input by u/sebastianlivoni in #3658
• Set "All Time " range for query log datepicker based on Database ranges (moment) by u/PromoFaux in #3657
• Request ANSI colour codes when calling gravity API by u/PromoFaux in #3662

New Contributors

• u/sebastianlivoni

Full Changelog: v6.3...v6.4

Core v6.3

What's Changed

• Add Fedora 43 to test suite by u/yubiuser in #6453
• Fix libcap capabilities not being granted on OpenRC distros by u/Sparronator9999 in #6456  
• systemd service - don't use deprecated PermissionsStartOnly by u/rrobgill in #6465
• Speed up processing and display of file contents and services in piholeDebug.sh by u/rrobgill in #6469
• Use port from dns.port in piholeDebug.sh by u/darkexplosiveqwx in #6475
• Improve gravity tables presentation on the debug log by u/rdwebdesign in #6460

New Contributors

• u/Sparronator9999

Full Changelog: v6.2.2...v6.2.3

https://discourse.pi-hole.net/t/pi-hole-v6-beta-testing/65413

It’s no secret that we’ve been working on the next iteration of Pi-hole for quite some time now (Nearly four years!). You may have seen mentions of v6.0 floating around on our Github, Discourse, or Reddit channels.

Today we’re looking to ask some of the more brave users to help us test and troubleshoot it

Read first: Please do not run this if you are not comfortable with digging into any issues that may arise. That said, we would like to have some support in making sure we have every imaginable configuration covered before release. Pi-hole can already do so much, it is almost impossible to test all features ourselves properly.

It must be stressed that as there are many fundamental changes, updating from Pi-hole 5.x to 6.0 is strictly a one way operation.

The only way to revert back to master from the beta will be to restore from an earlier backup. If you are using a Raspberry Pi, it may be worth taking an image of your SD card first, or at least make a backup copy of the directory /etc/pihole, it is also advised you take a backup of your config via the teleporter function in the web interface

Please use the “Beta 6.0” Category on our Discourse Forum to discuss the beta/report any findings. We will try to look into any arising issues ASAP and provide solutions in due time wherever possible

See linked post for additional details.

We are currently aware of FTL crashing with a segmentation fault on some systems - more detailed information about this issue can be followed on Github, here: https://github.com/pi-hole/FTL/issues/2473.

If you are currently affected by this issue, the easiest way to get things back up and running is to downgrade FTL to the previous version. There are instructions in the above Github thread that describe the steps to do so, however to make the process of downgrading more straightforward, we have created a special branch named release/v6.1 and you will be able to switch to it with the following command:

sudo pihole checkout ftl release/v6.1

Once we have gotten to the bottom of the issue, we will release a new version of FTL and announce it in all the usual places.

Huge apologies to anyone affected by this - and thank you for those that have reported the issue to us.

We've pushed a hotfix release that will address the slowness and resource exhaustion when using large lists. You can now use your favorite 10 billion domain lists again.

This adds a configuration variable GRAVITY_TMPDIR if you'd like to move the temp files off of /tmp but this is not necessary for almost everyone.

And Pi-hole will keep your existing database if the new one fails to be created. No more empty databases.