ISC BIND, CVE-2015-5477: on CISA's exploited list

The bottom line

If you run BIND as a DNS server, act now: CISA's deadline of 11 October 2026 has already passed. Check the version first. If you run no BIND, you can stop reading.

Free analysis report · 8 pagesISC BIND, CVE-2015-5477: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

A remote attacker can send specially crafted TKEY queries to the BIND name server (named). The record says this triggers an assertion failure and the daemon exits, so DNS stops answering until it is restarted.

Why it matters

The record gives a score of 7.5 and describes a denial of service only, not code execution or data theft. Our reading is that the use is taking down name resolution: when DNS stops, mail, web access and remote logins that depend on it fail too. Because CISA lists it as exploited, a name server that is reachable from the internet and not updated should be treated as a known target.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "It is only a denial of service, so it can wait." CISA lists it as exploited, and the record says the daemon exits. A stopped name server takes down everything that needs DNS.
• "The record is from 2015, so we must have patched it long ago." Age does not show a fix. Old servers and embedded builds can still be on affected versions, so check the version.
• "We would see an attack in our logs." The record does not say what a hit looks like. Do not rely on seeing it beforehand.

How we would triage it

This is our judgement.

The commands only read: they print a version or list what is installed. They come from general knowledge of this kind of product, not from the sources, so check them against the vendor's page before you run them. Words in capitals are for you to fill in.

Step 1: Find where BIND runs and which version

• Ask your IT provider for a list of DNS servers, including any inside routers or appliances.
• On each one, read the installed BIND version and compare it with the affected range on this page.

named -v
dpkg -l | grep -i bind9

Step 2: Reduce exposure while you plan the update

• Allow queries only from the networks that need them. The record does not name a workaround, so this is general hygiene, not a fix.
• Make sure a restart of the named service is quick, because the record says the daemon exits.

Step 3: Update to a fixed build

• No source here names a fixed version. Ask the vendor or your operating system supplier which build fixes CVE-2015-5477, and install it.
• Follow CISA's required action for the forensics step as well.

Step 4: Confirm the result

• Re-read the version on each server after the update.
• Ask for written confirmation that every BIND instance is on the fixed build.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello. CISA lists CVE-2015-5477, a denial-of-service flaw in ISC BIND (named) triggered by TKEY queries. Please tell us whether we run BIND anywhere, including inside routers or appliances, and which version each one is. Please also confirm which build fixes this CVE for each system, and whether any server answers queries from the internet. If any is affected, please update it and send us written confirmation of the new version by the end of this week. CISA's deadline of 11 October 2026 has already passed. Thank you.

Signs it was used

An update closes the hole. It does not tell you whether someone used it first. CISA's required action points to its forensic triage requirements (BOD 26-04). Look for:

• Unexpected exits or restarts of the named service, particularly with an assertion message in its log.
• Gaps in DNS answers on the server at the times it stopped.
• Incoming TKEY queries from addresses you do not recognise, if your server logs query types.

The weakness behind it

CISA's entry classes this as CWE-19.

The sources, in their words

CISA's catalogue entry:

ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

The CVE record, published by Mitre on 29 July 2015:

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

The record gives no version ranges. Use the vendor's advisory for the affected versions.

CISA's required action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

What we do not know yet

• Which BIND version is the first unaffected one: no vendor page could be read.
• Whether a workaround exists short of updating.
• What an attack looks like in logs or on the system.
• Whether embedded or vendor-packaged BIND builds are affected.
• We have not tested this against any environment. Versions and scores are as the sources state them and as at 1 November 2026; the vendor's advisory wins where it differs.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.
• The CVE Triage Handbook →How to check, analyse and triage a CVE. Free with registration.