VulnSocial
← Back to blog

CVE-2015-5477 – ISC BIND DoS Vulnerability Added to CISA Known Exploited Vulnerabilities Catalog

Severity: HIGH
CVSS: 7.5 (3.1) / 7.8 (2.0)
Status: CISA KEV added Oct 8, 2026
Impact: Denial of Service via crafted TKEY DNS queries
Action: Apply ISC BIND 9.9.7-P2 or 9.10.2-P3 immediately

ISC BIND, one of the world's most widely deployed DNS servers, has been added to the CISA Known Exploited Vulnerabilities catalog — a signal that attackers are actively exploiting this flaw. The vulnerability allows remote attackers to trigger a REQUIRE assertion failure and daemon crash via malformed TKEY DNS queries.

Overview

CVE-2015-5477 is a denial-of-service flaw in ISC BIND affecting versions before 9.9.7-P2 and 9.10.2-P3. It was disclosed in July 2015 but remained unpatched for over a decade before being flagged as exploited by CISA in October 2026. The vulnerability sits at the intersection of availability and processing errors — no remote code execution, but a complete daemon outage when triggered.

The CISA KEV listing means federal agencies face a hard deadline (Oct 11, 2026 per BOD 26-04) to apply mitigations. For non-federal organizations, the risk remains elevated because exploit code exists on public repositories and the flaw is trivially triggerable over the network.

Technical Details

The root cause is a missing validation in BIND's TKEY query handling path. An attacker can send a crafted TKEY query that triggers a REQUIRE assertion failure during name processing, causing the daemon to abort. The attack surface is network-facing with no authentication required — AV:N, low complexity. The bug was assigned CWE-19 and CWE-617 classifications.

Two independent CVSS scores exist: a 7.5 under CVSS v3.1 (network, low complexity, no privilege needed, affects availability only) and a 7.8 under CVSS v2.0. Both land in the HIGH severity band.

Severity & Impact

This is strictly an availability issue — no confidentiality or integrity breach is possible through this vector. The daemon crashes, and DNS resolution for affected zones fails until restart. For organizations relying on BIND as their primary resolver or authoritative server, this translates to immediate service disruption upon attack. The exploitability is high: the attack requires no credentials, no user interaction, and no prior access.

Affected Products

The vulnerability spans ISC BIND across multiple operating systems and distributions:

  • ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3
  • Representative distributions: Red Hat Enterprise Linux, Debian, Ubuntu, SUSE, Fedora, Oracle Linux, HP-UX, OpenVMS, Juniper Junos

For the full list of affected products and versions, see the CVE page.

Actionable Insights

If you operate ISC BIND:

  1. Patch immediately. Upgrade to ISC BIND 9.9.7-P2 or 9.10.2-P3. Check your current version against the advisory matrix.
  2. Audit exposure. Confirm whether your BIND instances accept recursive queries from external networks. If they do, assume active exploitation is occurring — even if you haven't seen incidents, attackers are probing.
  3. Monitor logs. Watch for abnormal TKEY query volumes or assertion failures in syslog. A spike in named crash messages is the primary detection signal.
  4. Implement rate limiting on recursive responses if the server must remain online during investigation. A defensive mitigation can reduce blast radius while patching completes.

For federal agencies: CISA's BOD 26-04 mandates compliance by Oct 11, 2026. Non-compliance risks mandatory discontinuation of the product if mitigations are unavailable. Prioritize this fix among your highest-priority patches.

Remediation & Mitigation

  1. Apply the upstream fix: Upgrade ISC BIND to 9.9.7-P2 or 9.10.2-P3. Verify with named -v after installation.
  2. Test before production rollout. Validate that zone loading and TKEY handling behave correctly under load testing.
  3. Deploy temporarily if needed: If a patch is unavailable for your distribution, restrict recursive query acceptance to trusted networks as a stopgap.
  4. Document the remediation. Record the version change, testing date, and verification steps for audit trails.

References

Bottom Line

CVE-2015-5477 is a decade-old denial-of-service flaw in ISC BIND now confirmed as actively exploited. With CISA KEV inclusion and publicly available exploit code, every BIND operator should treat this as urgent. Apply the 9.9.7-P2 or 9.10.2-P3 patch now — do not wait for incident evidence to act.

#CVE #CISAKEV #ISCBIND #DNS #DenialOfService #RiskManagement #CyberDefense