CVE-2015-5477: ISC BIND TKEY DoS
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-08. Federal agencies must patch by 2026-10-11.
TL;DR - A crafted TKEY DNS query can trigger a
REQUIREassertion and stop the ISC BINDnameddaemon. - Affected BIND branches include 9.1.0–9.8.x, 9.9.0–9.9.7-P1, and 9.10.0–9.10.2-P2. - Public PoCs exist, and CISA lists the CVE as exploited in the wild; patch exposed systems urgently.
Summary
CVE-2015-5477 is a remotely exploitable ISC BIND vulnerability that causes denial of service. The vulnerable code processes specially constructed TKEY records in DNS queries. Under the triggering conditions, named hits an internal REQUIRE assertion and exits or crashes. Recursive or authoritative DNS service remains interrupted until the process is restarted and the underlying exposure is remediated.
Organizations reviewing broader DNS and infrastructure risks may also benefit from this guide to small-business backup strategy and this overview of least privilege in cloud security.
| Field | Value |
|---|---|
| CVE ID | CVE-2015-5477 |
| CVSS | 7.5 High |
| Attack vector | Network |
| Authentication required | No |
| Privileges required | None |
| Primary impact | Availability |
| Patch available | Yes |
| Fixed upstream versions | BIND 9.9.7-P2 and 9.10.2-P3 |
Based on the supplied technical information, the vulnerability does not provide a path to arbitrary code execution, data disclosure, or integrity compromise. Its practical consequence is DNS service disruption. Recursive resolvers may stop answering client requests, authoritative servers may become unreachable, and dependent applications can fail when DNS lookups time out.
The vulnerability’s age does not make it irrelevant. Public exploit code is available, and the supplied CISA data identifies CVE-2015-5477 as a Known Exploited Vulnerability. The research note reports a CISA catalog addition date of October 8, 2026, with an October 11, 2026 remediation deadline; verify the live catalog before using those dates for compliance evidence.
Root Cause
The vulnerable behavior is in BIND’s handling of TKEY queries. TKEY is used in DNS authentication and key-management contexts, including operations associated with TSIG. A deliberately constructed query can reach an error-handling path that violates an internal BIND assertion. Instead of safely rejecting the request, the named process terminates when the REQUIRE condition fails.
The attack sequence is straightforward at a high level:
- An attacker sends a crafted DNS query containing TKEY data to an affected BIND server.
namedparses and processes the request.- The vulnerable path triggers a
REQUIREassertion failure. - The daemon exits or crashes.
- DNS service remains unavailable until automated or manual recovery occurs.
This is a data-processing error, identified as CWE-19 in the supplied research. The attacker does not need an account or authenticated DNS credentials when the server is reachable. Whether a particular server is exploitable depends on its BIND version, network exposure, and any intervening DNS or firewall controls.
Technical Notes
A crash may leave evidence in the service manager, system journal, or BIND log. Typical indicators include assertion-related text, an unexpected named exit, or repeated restart activity. Exact wording varies by build and operating system, so defenders should correlate process termination with DNS query telemetry rather than relying on one string.
named[PID]: REQUIRE failure
named[PID]: exiting due to assertion failure
systemd[1]: named.service: Main process exited
systemd[1]: named.service: Scheduled restart job
These are detection patterns, not guaranteed literal output for every platform. Preserve crash logs and core-dump metadata where permitted, especially if the system is internet-facing or shows repeated restarts.
Who’s Exposed
Upstream ISC BIND versions identified as affected are:
| Product | Affected versions | Fixed upstream version |
|---|---|---|
| BIND 9.1 | 9.1.0 through 9.8.x | Upgrade to a supported release or vendor-fixed package |
| BIND 9.9 | 9.9.0 through 9.9.7-P1; NVD configuration data also represents versions through 9.9.7 | 9.9.7-P2 |
| BIND 9.10 | 9.10.0 through 9.10.2-P2; NVD configuration data also represents versions through 9.10.2 | 9.10.2-P3 |
The affected versions are obsolete or end-of-life in many environments. A displayed package version may not directly reveal whether the fix is present because Linux distributions and appliance vendors commonly backport security patches without changing the upstream major and minor version. Check the operating system security advisory, package changelog, or appliance release notes before declaring an asset vulnerable or fixed.
Products that embed or package BIND may also be exposed. The supplied research identifies Juniper and F5 advisories covering products with vulnerable BIND components. Assess network appliances, managed DNS platforms, and specialized resolver products by product release and vendor advisory, not only by querying the service for a BIND banner.
Internet-facing recursive resolvers and authoritative name servers deserve priority. Internal-only DNS servers still matter because an attacker who can reach them may be able to cause an outage, but exposure through UDP or TCP port 53 increases the likelihood of remote attack. Inventory directly installed BIND servers alongside appliances that use BIND internally.
Severity Breakdown
CVE-2015-5477 has a CVSS v3 base score of 7.5 High. The supplied research confirms that the vulnerability is network-reachable, does not require authentication, and primarily affects availability. The NVD vector string was not included in the research note, so defenders should verify the authoritative vector directly in the NVD record before reproducing the score in a formal risk register.
| CVSS-related factor | Assessment |
|---|---|
| Attack vector | Network |
| Authentication | Not required |
| Privileges required | None |
| User interaction | Not required for the server-side impact |
| Confidentiality | No stated impact |
| Integrity | No stated impact |
| Availability | High impact through daemon termination |
The score understates some operational consequences for DNS-dependent environments because CVSS describes the vulnerability’s technical impact rather than the full business dependency chain. A crash of an authoritative DNS service can affect name resolution for public applications, while a recursive resolver outage can interrupt authentication, software updates, API access, and internal application workflows.
There is no supplied evidence that this CVE enables code execution or privilege escalation. Risk assessments should focus on service availability, redundancy, restart behavior, exposure, and the ability to detect repeated attacks. Multiple redundant DNS servers reduce, but do not eliminate, the impact of a successful attack.
Exploitation Status
Exploitation is confirmed in the wild according to the supplied CISA Known Exploited Vulnerabilities data. The research reports that CISA added CVE-2015-5477 to the catalog on October 8, 2026, with a remediation deadline of October 11, 2026. It also reports that ransomware campaign use is unknown. Confirm the live CISA catalog before citing these dates in an audit or compliance submission.
Public proof-of-concept code is available. The research identifies repositories from Robert Graham and knqyf263 that can send a triggering TKEY request or test whether a BIND server is susceptible. The existence of these PoCs means defenders should assume that opportunistic scanning and low-skill exploitation are feasible. Do not test a PoC against production DNS infrastructure without authorization and a recovery plan.
The combination of public PoCs and KEV status changes the operational response. This is not merely a historical, theoretical crash flaw. Treat an exposed affected service as an emergency remediation candidate, review telemetry for prior crashes, and investigate unexplained DNS outages for possible exploitation.
Analyst’s Take: Prioritize internet-facing BIND servers first, especially recursive resolvers and authoritative name servers, because the flaw requires network reachability and can stop
named. CISA KEV status and the availability of public PoCs justify treating unexplained crashes or restart loops as possible exploitation while patching proceeds.
Sources
The primary technical references are the NVD record and ISC’s vendor advisory. NVD provides the vulnerability identification, affected-version data, and CVSS record. ISC documents the BIND-specific defect and fixed upstream releases. Use these references first to validate version status and the authoritative CVSS vector.
Additional references provide downstream applicability, exploitation context, and technical analysis:
| Source | Use |
|---|---|
| NVD: CVE-2015-5477 | CVE record, affected configurations, and CVSS validation |
| ISC advisory AA-01272 | Vendor description and fixed BIND releases |
| Juniper JSA10718 | Juniper product applicability |
| F5 K16909 | F5 product and hotfix applicability |
| AWS security bulletin | AWS package and platform status |
| Robert Graham PoC | Public exploit and detection research |
| knqyf263 PoC | Public vulnerability check |
| Cloudflare technical analysis | TKEY processing and mitigation context |
The supplied research did not provide a measured live count for general news or social mentions, nor an EPSS percentile. The frontmatter values of 0 and 0.0 therefore indicate unavailable research-note counts, not evidence that no mentions or exploitation probability exist. Use the current NVD, CISA, EPSS, and vendor records when those metrics are required for an operational or compliance decision.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Start with service-health telemetry. Alert on unexpected named exits, assertion failures, core dumps, and repeated restarts. A single crash may have another cause, but a crash correlated with inbound TKEY queries or traffic from an unusual external source should be escalated. Monitor both the primary DNS process and the service manager because a restart loop can make the service appear intermittently available.
DNS query logging can help identify suspicious requests, but TKEY-specific logging is deployment-dependent. Avoid enabling verbose query logging indefinitely on high-volume resolvers because it can create substantial disk and CPU overhead. Use short, controlled collection windows, network metadata, and service logs instead.
Technical Notes
Example systemd and journald queries:
# Review recent named service failures
journalctl -u named --since "24 hours ago" \
| grep -Ei 'assert|REQUIRE|abort|segfault|exited|restart|core'
# Check current service state and recent restart count
systemctl status named
systemctl show named -p NRestarts -p ExecMainStatus -p ActiveEnterTimestamp
# Search common BIND log locations
grep -RniE 'assert|REQUIRE|TKEY|named.*(exit|abort|crash)' \
/var/log/named /var/log/messages /var/log/syslog 2>/dev/null
A network-monitoring rule should flag TKEY queries directed at externally reachable BIND servers and correlate them with process exits or restarts. Validate the precise DNS signature in a test environment because packet encoding and legitimate TKEY use vary. A practical detection workflow is to identify DNS requests whose query type is TKEY, record source and destination addresses, and join those events to a named crash or restart within a short time window.
Remediation Steps
Upgrade affected upstream installations to BIND 9.9.7-P2 or BIND 9.10.2-P3, or, preferably, to a currently supported BIND release that includes the fix. Do not deploy those historical fixed versions blindly if they are unavailable or unsupported on the operating system; use the operating system or appliance vendor’s security update containing the CVE fix.
For downstream products, validate the vendor-specific release or hotfix. The supplied research identifies Juniper advisory JSA10718 and F5 advisory K16909. F5 product branches and hotfix levels must be checked in the current F5 advisory before deployment. Apply the same principle to cloud images, managed DNS appliances, and distribution packages with backported patches.
During emergency remediation, restrict administrative access to approved networks and use a password manager for shared recovery credentials and break-glass procedures. Teams that need a managed credential vault can evaluate Try 1Password → as one option, but tooling does not replace patching or network controls.
Technical Notes
On Debian- or Ubuntu-based systems, use the supported repository package rather than compiling an obsolete BIND branch:
sudo apt-get update
sudo apt-get install --only-upgrade bind9 bind9-utils
sudo systemctl restart bind9
sudo systemctl is-active bind9
On Red Hat-derived systems, the equivalent package names and repositories depend on the release:
sudo dnf update bind bind-utils
sudo systemctl restart named
sudo systemctl is-active named
Before closing the change, verify the installed package changelog or vendor advisory includes the CVE fix. Confirm that the daemon is running, authoritative answers remain available, recursion works where intended, and monitoring shows no restart loop.
If immediate patching is impossible, reduce exposure as a temporary control. Restrict UDP and TCP port 53 to approved networks where operationally feasible, remove unnecessary internet exposure, limit recursion to trusted clients, and isolate or disable an affected service if a redundant replacement is available. These controls reduce attack reachability but do not fix the vulnerable code. There is no supplied evidence that simply disabling TKEY through a configuration directive is a reliable workaround; do not assume that such a setting neutralizes the issue without explicit vendor guidance.