CVE-2015-5477: ISC BIND TKEY Query Denial of Service (KEV)

CVE-2015-5477 is a reachable-assertion denial-of-service in ISC BIND 9's handling of TKEY queries: a single crafted packet makes the named daemon exit, affecting both recursive and authoritative servers regardless of ACLs, and CISA added this decade-old flaw to the Known Exploited Vulnerabilities catalog on 2026-10-08 after observing renewed in-the-wild exploitation of unpatched legacy installs.

CVE-2015-5477 is a data processing error (CWE-19, reachable assertion CWE-617) in ISC BIND 9. NVD's description states: "named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries" (NVD).

NVD lists the CVE as "Analyzed" and records both a CVSS v2.0 primary score of 7.8 (vector AV:N/AC:L/Au:N/C:N/I:N/A:C) and a CVSS v3.1 secondary score of 7.5 (high, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to availability only (NVD).

ISC's own knowledge-base advisory explains that "both recursive and authoritative servers are vulnerable to this defect," and that exposure "is not prevented by either ACLs or configuration options limiting or denying service" because the exploitable code runs early in packet handling, before those checks apply; ISC's advice is to upgrade to BIND 9.9.7-P2 or 9.10.2-P3, with no workaround available for operators who cannot upgrade immediately (ISC Knowledge Base AA-01272).

Although originally disclosed in July 2015, CISA added CVE-2015-5477 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-08, with a required-action due date of 2026-10-11 under Binding Operational Directive 26-04, and lists known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.9958 (99.45th percentile) — among the highest EPSS scores observed for any advisory on this site, consistent with mass scanning or exploitation of still-unpatched, decade-old BIND installs now that the flaw has been re-weaponized (FIRST EPSS).

Any BIND 9 installation still running a version older than 9.9.7-P2 or 9.10.2-P3 should be upgraded immediately; given the 2026 KEV listing and near-maximal EPSS score, operators should also check for signs of prior denial-of-service activity against exposed DNS infrastructure.

• A crafted TKEY query against ISC BIND 9.x before 9.9.7-P2 or 9.10.x before 9.10.2-P3 causes a REQUIRE assertion failure and daemon exit (CWE-19/CWE-617). — NVD
• CVSS v2.0 primary score is 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C); CVSS v3.1 secondary score is 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), per NVD status Analyzed. — NVD
• Both recursive and authoritative BIND servers are affected regardless of ACL/configuration restrictions, because the exploitable code runs before those checks; no workaround exists, upgrade to 9.9.7-P2 or 9.10.2-P3. — ISC Knowledge Base AA-01272
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-08, due date 2026-10-11, known ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.9958 (99.45th percentile) as of 2026-10-26. — FIRST EPSS