NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

ISC BIND DNS server crash flaw CVE-2015-5477 (TKEY queries) added to CISA's exploited list

A 2015 flaw in the BIND DNS server (CVE-2015-5477) was added to CISA's exploited list on 8 Oct 2026. One crafted packet can crash named. Fixed since 2015 in 9.9.7-P2 and 9.10.2-P3. Home users: nothing to do. Anyone running old BIND: update.

What to do

Nothing for most families to do. If you run or manage a DNS server, or an old appliance with BIND built in, update to a supported BIND release or your vendor's patched version; ask your IT provider if unsure.

What’s happening

CVE-2015-5477 is a denial-of-service flaw in ISC BIND 9, the widely used DNS server software. A single crafted TKEY query makes the server process (named) stop with an assertion failure, on both authoritative and recursive servers, and access controls do not prevent it. ISC disclosed and fixed it on 28 July 2015, rating it critical with a CVSS score of 7.8, and said there is no workaround. Affected are BIND 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1 and 9.10.0 through 9.10.2-P2; the fixes are 9.9.7-P2 and 9.10.2-P3. Red Hat shipped backported fixes for Enterprise Linux 6 and 7 the same day. ISC noted on 1 August 2015 that public exploit code existed. CISA added the flaw to its list of vulnerabilities being used in attacks on 8 October 2026. Which attackers, or how widely, was not found in the pages read. Only very old, unpatched servers are at risk; ordinary home devices are unlikely to run affected BIND versions, though old routers or appliances with embedded BIND could.

What
Flaw
Affects
ISC BIND 9 DNS server
Affected
ISC BIND 9.1.0 through 9.8.x
ISC BIND 9.9.0 through 9.9.7-P1
ISC BIND 9.10.0 through 9.10.2-P2
Red Hat Enterprise Linux 6 and 7 bind packages (before RHSA-2015:1513)
Fixed in
BIND 9.9.7-P2
BIND 9.10.2-P3
RHEL 7: bind-9.9.4-18.el7_1.3
RHEL 6: bind-9.8.2-0.37.rc1.el6_7.2
CVE
CVE-2015-5477
Since
8 Oct 2026
Closed
8 Oct 2026

Timeline

  1. CISA added

    CISA added CVE-2015-5477 to its list of flaws being used in attacks. Trackers cite a federal remediation date of 2026-10-11; CISA's own catalogue was not checked. No details of the attacks were found.

  2. Update

    ISC updated its advisory to say a third party had published proof-of-concept exploit code publicly.

  3. New fixFixed

    Red Hat issued RHSA-2015:1513 with fixed bind packages for Red Hat Enterprise Linux 6 (bind-9.8.2-0.37.rc1.el6_7.2) and 7 (bind-9.9.4-18.el7_1.3).

  4. Made publicFixed

    ISC publicly disclosed CVE-2015-5477: a crafted TKEY query can make the BIND name server (named) exit. Fixed releases 9.9.7-P2 and 9.10.2-P3 were announced; ISC said there is no workaround.

Sources

  1. ISC BIND advisory AA-01272: TKEY query assertion failure (CVE-2015-5477)ISC · 28 July 2015
  2. RHSA-2015:1513 bind security updateRed Hat · 28 July 2015
  3. CVE-2015-5477 vulnerability tracker entrystack.watch · 8 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS