Advisory severityHigh7.5Red Hat Linux

High [CVE-2026-77692] Remote Denial of Service via crafted DNS-over-HTTPS request

This high-severity Red Hat Linux advisory covers CVE-2026-77692; related products: Red Hat Hardened Images.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-77692 Source published Sep 16, 2026Source updated Sep 16, 2026

VulniPulse record published Sep 17, 2026Record updated Sep 24, 2026

CVE-2026-77692

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Remote Denial of Service via crafted DNS-over-HTTPS request. Red Hat rates this important (CVSS 7.5).

Weakness: CWE-617. Red Hat lists fixing advisory RHSA-2026:68279 with package bind-main-9.20.29-0.1.hum1.

Affected product named by the advisory: Red Hat Hardened Images.

Affected versions

9.20.0
9.20.27
9.21.0
9.21.25
9.20.9

Official advisory · high-confidence parse· fetched 13 days ago·verify at source

Fixed versions

bind-main-9.20.29-0.1.hum1
RHSA-2026:68279

Official advisory · high-confidence parse· fetched 13 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

To mitigate this issue, restrict access to the BIND service to trusted clients only, or disable DNS-over-HTTPS if it is not required. To restrict network access to the BIND service, configure firewall rules to only allow connections from trusted IP ranges to port 53 (UDP and TCP). For example, using `firewalld`: `firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_RANGE>" port port="53" protocol="udp" accept'` `firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_RANGE>" port port="53" protocol="tcp" accept'` `firewall-cmd --reload` If DNS-over-HTTPS is enabled and not essential, consider disabling it in the BIND configuration. Refer to the BIND administrator's reference manual for instructions on disabling DNS-over-HTTPS. Changes to BIND configuration require a restart of the `named` service for them to take effect.

Official advisory · high-confidence parse· fetched 13 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.