favonia/cloudflare-ddns v1.18.0

1.18.0 (SECURITY UPDATE)

on GitHub

Update promptly to this version (1.18.0) for HTTPS security fixes. This release also fixes failure reporting for one-shot work and shutdown cleanup, along with one-shot WAF list deletion.

Security

Compromised eMudhra certificate authority keys allow attackers to forge HTTPS certificates for websites they do not control. An attacker who can intercept or redirect the updater’s HTTPS connections could use these certificates to impersonate an IP detection service or the Cloudflare API. The default configuration is affected.

Docker images are built with Go 1.27.3, which rejects certificate chains containing the compromised keys (CVE-2026-111943 and the Go security announcement). The images also include the security fixes in Go 1.27.2.

To upgrade, pull the updated image and recreate your container. If you build from source, rebuild with Go 1.27.3 or a later patched version.

Improvements and Fixes

• Exit status reports failed work. Failed or interrupted one-shot work (UPDATE_CRON=@once) and failed shutdown cleanup (DELETE_ON_STOP=true) now return 1 instead of 0. Update failures during a scheduled run do not affect its exit status on normal shutdown. See Exit Status for details. (#1290)
• One-shot cleanup can now delete WAF lists. Previously, runs with UPDATE_CRON=@once and DELETE_ON_STOP=true cleared managed WAF items but did not attempt to delete the lists themselves. (#1289, #1290)