CVE-2015-5477: ISC BIND TKEY Query Flaw Enables Remote Denial of Service (CVSS 7.5 HIGH)

What Is the Flaw?

CVE-2015-5477 is a data-processing error (classified under CWE-19 and CWE-617) in the named daemon of ISC BIND. When the daemon receives a specially crafted TKEY query, it hits an internal REQUIRE assertion that it cannot satisfy, causing the process to exit immediately.

Because the flaw is triggered at the query-handling layer — before authentication — no credentials or prior access are required. The attack path is network-accessible, low complexity, and requires no user interaction, as reflected in its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and a score of 7.5 HIGH.

The vulnerability was publicly disclosed on 29 July 2015 and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 8 October 2026, signalling confirmed exploitation interest warranting urgent remediation.

Who and What Is Affected?

According to the NVD advisory, the following BIND releases are vulnerable:

• BIND 9.x — all versions before 9.9.7-P2
• BIND 9.10.x — all versions before 9.10.2-P3

Any organisation running an authoritative or recursive DNS resolver on an unpatched BIND version within these ranges is exposed. Because DNS is foundational infrastructure, the impact is broad: internet-facing resolvers, internal enterprise DNS servers, and hosted DNS services built on BIND are all at risk if not upgraded.

Administrators should audit every host running named — including systems where BIND may have been installed as a dependency or bundled with another package — to confirm the installed version.

What Is the Impact?

The direct impact is complete availability loss of the BIND daemon. A single malformed TKEY packet is sufficient to crash named; the CVSS availability sub-score is rated High with no confidentiality or integrity impact recorded.

In practice, this translates to:

• DNS outage — recursive resolvers stop answering queries, breaking internet connectivity for clients that rely on them.
• Authoritative DNS outage — zones become unresolvable, making web, mail, VPN, and other services unreachable.
• Repeated crash loop — if the daemon is set to auto-restart without filtering the malicious traffic, the attacker can sustain the outage with repeated queries.
• Downstream cascade — services and applications that depend on DNS resolution fail silently or loudly, multiplying business impact beyond the DNS server itself.

There is no confidentiality or integrity impact recorded in the CVSS vector; this is a pure denial-of-service vulnerability.

What Should You Do Right Now?

The primary remediation is straightforward: patch.

1. Upgrade BIND immediately to 9.9.7-P2 or later on the 9.9.x branch, or to 9.10.2-P3 or later on the 9.10.x branch, per ISC's own advisory. If you are running any 9.x release below these thresholds, treat the system as actively at risk.
2. Prioritise internet-exposed resolvers. CISA's BOD 26-04 guidance requires organisations to evaluate each asset's internet exposure and adhere to patching timelines based on that exposure. Internet-facing DNS servers should be patched first.
3. Restrict query sources where possible. As a temporary workaround while patching is in progress, consider restricting TKEY query acceptance via BIND's allow-query or firewall ACLs to known-trusted sources only. This is a mitigation, not a fix.
4. Enable monitoring and alerting on named process crashes and unexpected restarts; a sudden daemon exit may be an indicator of exploitation attempts.
5. Consult CISA forensic triage requirements. The CISA KEV entry for this CVE references CISA's Forensics Triage Requirements. If you have reason to believe exploitation has already occurred, follow those procedures before simply patching over a potentially compromised host.
6. Discontinue use if mitigations are unavailable. Per CISA KEV required action: if the vulnerable product cannot be patched or mitigated, discontinue its use.

Primary public sources for further detail: CISA KEV Catalog, NVD — CVE-2015-5477, and ISC's own security advisories at isc.org.

How Continuous External Testing Surfaces This Exposure

One of the persistent challenges with CVE-2015-5477 — and vulnerabilities like it — is that BIND instances can lurk on network segments that security teams do not actively monitor. Legacy DNS servers, secondary resolvers, and development or staging environments running outdated BIND versions are frequently overlooked in point-in-time assessments.

Continuous external attack-surface testing addresses this by:

• Discovering all internet-exposed DNS services across your IP ranges, not just the ones you remember you deployed.
• Version fingerprinting DNS daemons to flag instances running versions known to be vulnerable without sending harmful payloads.
• Alerting in near-real time when a newly spun-up or reconfigured host exposes a vulnerable BIND version — a gap that quarterly pen tests miss entirely.
• Mapping remediation progress so security and operations teams can verify that patches have been applied and that no asset has regressed after a rebuild or rollback.

For a vulnerability with a network-accessible, zero-authentication attack path like CVE-2015-5477, the window between deployment of a vulnerable host and an attacker discovering it can be hours, not weeks. Continuous visibility closes that window.

Frequently asked questions

Is CVE-2015-5477 being actively exploited in the wild?

This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog (added 8 October 2026), which indicates that CISA has determined it has been exploited. Organisations should treat it as an active threat and prioritise remediation accordingly.

Does this vulnerability affect all BIND 9 versions?

According to the NVD advisory, affected versions are BIND 9.x before 9.9.7-P2 and BIND 9.10.x before 9.10.2-P3. If you are running patched versions at or above these thresholds, you are not vulnerable to this specific flaw — though you should ensure BIND is kept up to date for other vulnerabilities.

Can a firewall block this attack without patching?

Restricting TKEY queries at the firewall or via BIND's ACLs can reduce the attack surface as a temporary measure, but it is not a substitute for patching. Firewall rules can be misconfigured, bypassed, or fail to cover all network paths. ISC's recommended fix is upgrading to a patched release.

What is CISA BOD 26-04 and how does it apply here?

CISA Binding Operational Directive 26-04 requires federal agencies — and is recommended best practice for all organisations — to prioritise security updates based on asset internet exposure and risk. For CVE-2015-5477, the CISA KEV required action explicitly references BOD 26-04 and mandates that stakeholders evaluate each affected asset's exposure and patch within the directive's timelines.