cyfenced.com →

[ CVE-2015-5477 · Published 29 Jul 2015 ]

Crafted TKEY queries crash ISC BIND DNS servers

Exploited · CISA KEV CVSS 7.5 EPSS 99%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-08
  • EPSS: 99% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited and a single unauthenticated query is enough, although most systems were patched years ago.

Red alert if
You still run BIND older than 9.9.7-P2 or 9.10.2-P3, or appliances that embed it, on DNS servers reachable from the internet.
Can wait if
Your DNS servers run any supported BIND release from the last several years, or you do not use BIND.
What it is
A flaw in how ISC BIND handles TKEY queries makes the named DNS server stop with an assertion failure. BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 are affected. The flaw dates from 2015 but CISA added it to its exploited list in October 2026.
Impact
A single crafted query from anyone on the network can stop the DNS server, with no credentials. If that server answers DNS for your domains or your internal network, websites, email and internal applications stop resolving until it is restarted.

How an attack would work MITRE ATT&CK

  1. T1595.002 Active Scanning: Vulnerability ScanningAttackers scan for DNS servers that still run old BIND versions.
  2. T1499 Endpoint Denial of ServiceA crafted TKEY query makes named exit and stops DNS service.

What to do

  1. Upgrade BIND to a current supported release from your operating system vendor or ISC.
  2. Find devices that embed old BIND versions, such as older appliances or network operating systems, and update their firmware.
  3. Make sure named is restarted automatically and monitored, so a crash is noticed straight away.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

CISA: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 11 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ References ]References