Update docker.io/pihole/pihole Docker tag to v2026.09.0
On all three nodes I upgraded Pi-hole successfully by means of fully automated Watchtower Docker container update with dependency update facilitated by Mend's Renovate Bot.
This MR contains the following updates:
| Package | Update | Change |
|---|---|---|
| docker.io/pihole/pihole | minor | 2026.07.2 → 2026.09.0 |
Release Notes
pi-hole/docker-pi-hole (docker.io/pihole/pihole)
v2026.09.0
Whats Changed? (Docker)
Nothing Docker specific, tagging to include FTL v6.7.1
Full Changelog: https://github.com/pi-hole/docker-pi-hole/compare/2026.07.1...2026.09.0
Whats Changed? (FTL v6.7.1)
Security Fixes
- pi-hole/FTL/security/advisories/GHSA-2794-hrj8-5jg9 - Remote code execution and arbitrary file read via
webserver.advancedOpts(High) reported by keithlinneman - pi-hole/FTL/security/advisories/GHSA-ww5x-xx4x-qvjr - Remote code execution via exec-capable options in
misc.dnsmasq_lines(High) reported by keithlinneman - pi-hole/FTL/security/advisories/GHSA-gx63-h4w6-f46g - Configuration validators can be bypassed via Teleporter import, combined changes and document-root relocation (High)
- pi-hole/FTL/security/advisories/GHSA-7997-2868-rjfg - Stack buffer overflow in the blocked-answer path (Moderate) reported by 010011110
Behavior changes
misc.dnsmasq_linesandwebserver.advancedOptscan no longer be changed through the API or the web interface. They can still be set inpihole.toml, through environment variables and withpihole-FTL --config.- Wrong-method API requests now return 405 with an
Allowheader, andOPTIONSnames only the methods of the endpoint that fits the URI best. - The
CAP_NET_RAWstartup warning is gone, dnsmasq reports it when it actually needs the capability. database.maxDBdaysis an unsigned value now. A negative value kept the queries forever and is migrated to4294967295, which continues to do so.
Fixes of note
pi.holeand the local host name were answered with NODATA until restart once the interface cache went stale (#3050)- An infinite loop in the dnsmasq config test when
debug.configis enabled - Webserver workers spinning at 100% CPU in the mbedTLS debug callback (#3106)
- Async-signal-safety in the real-time signal handler and the TCP worker terminator
- Query indices that went stale while the shared memory lock was released, and a domain lookup that gave up at once when a list change was being committed
- Database connection leaks and counter skew, gravity regex and search-term handling, config write races, API error paths and response correctness
- Memory-safety hardening in the netlink parsers,
get_api_string(),base64_decode_update()and arp-scan
Full Changelog: https://github.com/pi-hole/FTL/compare/v6.7...v6.7.1
