CVE-2015-5477: ISC BIND TKEY Query Denial of Service

Background

BIND (Berkeley Internet Name Domain), maintained by the Internet Systems Consortium (ISC), is the most widely deployed DNS server software on the internet. It runs authoritative nameservers, recursive resolvers, and internal DNS infrastructure for an enormous share of organizations, ISPs, and hosting providers worldwide. Because DNS resolution is a prerequisite for nearly every other network service, availability of a BIND server is not a cosmetic concern — if the nameserver goes down, every service that depends on resolving names behind it effectively goes down too.

CVE-2015-5477 was originally disclosed by ISC in 2015, affecting BIND 9 installations that supported the TKEY resource record type (used in the DNS protocol for negotiating keying material, as specified in RFC 2930). Despite being over a decade old, the vulnerability was added to CISA’s KEV catalog in October 2026, which indicates it is still being actively exploited — a reminder that old, unpatched DNS infrastructure remains a live target long after a fix was originally published.

Technical Mechanism

CVE-2015-5477 is classified under CWE-19 (Data Processing Errors), consistent with its original ISC advisory description: a flaw in how BIND’s TKEY query-handling code processes certain inputs, resulting in a crash of the named process.

The mechanics of the original bug: when BIND is compiled with support for the TKEY resource record type (the default in affected versions) and receives a specially crafted packet containing a TKEY query, the query-handling logic encounters a code path that triggers a REQUIRE assertion failure in BIND’s internal consistency-checking framework. Because unhandled assertion failures are fatal in BIND’s design philosophy — the intent is to halt in a known state rather than operate in an undefined one — the named process terminates when the assertion fails.

The attack surface is any BIND server that will process a TKEY query at all: it does not require any form of authentication, any pre-existing trust relationship, or any state on the target. A single malicious UDP (or TCP) packet, correctly formed to reach the flawed code path, is sufficient to crash the service. This makes the vulnerability trivially remote-triggerable and trivially repeatable — an attacker can simply resend the crashing packet every time the service restarts to keep it down indefinitely.

Real-World Exploitation Evidence

CVE-2015-5477 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 2026-10-08. KEV listing is CISA’s confirmation that it has evidence of active exploitation of this vulnerability in the wild.

CISA’s knownRansomwareCampaignUse field for this entry is marked “Unknown” — CISA has not confirmed use of this vulnerability in ransomware campaigns at this time. No specific threat actor or named campaign is attributed to current exploitation of this CVE in the data available for this write-up; its re-emergence on the KEV list a decade after original disclosure most plausibly reflects opportunistic scanning for unpatched, internet-facing legacy BIND installations rather than a sophisticated or targeted campaign, but that characterization is reasoned from the vulnerability’s nature rather than confirmed by any published attribution, and should be treated accordingly. Organizations should not assume this bug is only of academic interest because of its age — its continued KEV listing says otherwise.

Impact Assessment

A CVSS score of 7.5 (high) reflects a pure availability impact: CWE-19 data-processing errors of this kind do not typically grant an attacker code execution, data access, or the ability to modify records — they crash the process. The impact is a straightforward denial-of-service condition on the targeted nameserver.

Because DNS sits at the foundation of the name-resolution chain, the consequences of a successful attack cascade well beyond the BIND process itself:

• Authoritative nameservers — domains served by a crashed authoritative server become unresolvable, effectively taking associated websites, mail, and other services offline for external users
• Recursive resolvers — an organization’s internal recursive resolver going down can halt outbound connectivity for every internal system and service that relies on name resolution
• Repeatable disruption — because the crash is triggered by a single stateless packet, an attacker can maintain an outage indefinitely by repeating the attack each time the service restarts, unless the underlying flaw is patched
• Amplification of other incidents — DNS outages during an otherwise unrelated incident (e.g., a separate security event) complicate incident response by removing visibility and connectivity tools that depend on name resolution

Sector risk is broad rather than narrow: any organization running an internet- or network-facing BIND nameserver on an affected version is exposed, including ISPs, hosting providers, enterprises running internal DNS, and critical infrastructure operators who depend on DNS for operational technology naming.

Affected Versions

ISC’s original 2015 advisory and the notes available here do not provide an exhaustive version table in the KEV data itself; the authoritative source for exact affected version ranges is ISC’s own security advisory (linked below) and any downstream vendor advisories (e.g., Red Hat, Juniper) for repackaged BIND distributions.

Given the age of this vulnerability, any BIND installation still running a version from 2015 or earlier without the relevant patch should be treated as affected and prioritized for immediate upgrade, regardless of the precise version boundary.

Remediation Steps

1. Identify all BIND nameservers in your environment and determine their exact version:

   named -v

2. Upgrade to a patched BIND release as specified in ISC’s advisory — for a decade-old CVE still appearing on KEV, the appropriate action is to move to a current, actively maintained BIND 9 release rather than simply applying the original 2015 point patch.
3. Apply the applicable vendor advisory for any repackaged or bundled BIND distribution (e.g., Red Hat’s RHSA-2015:1513, or the relevant Juniper Junos advisory) if you are not managing BIND directly from upstream source.
4. Where immediate patching is not possible, consider disabling TKEY processing or restricting which hosts can reach the nameserver’s query interface, as a stop-gap mitigation — consult your BIND configuration documentation (named.conf) for the relevant ACL and option settings.
5. Apply mitigations in accordance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance, and follow applicable cloud-service guidance or discontinue use of the product if mitigations are unavailable.
6. After patching, restart named and confirm the new version is running:

   systemctl restart named
   named -v

Detection Guidance

• Service availability monitoring — repeated, unexplained crashes or restarts of the named process are the primary observable symptom; monitor process uptime and service health checks for BIND instances
• DNS query logs — where query logging is enabled, look for TKEY-type queries from unexpected or external sources, particularly repeated identical or near-identical TKEY queries preceding a service crash
• System/crash logs — BIND assertion failures typically log a REQUIRE failure message to syslog or the configured BIND log channel immediately before the process exits; searching for named[ crash entries around outage windows can confirm this specific failure mode versus an unrelated cause
• Network-level filtering — intrusion detection systems with DNS protocol awareness may be able to flag malformed or anomalous TKEY query packets, though exact signatures should be sourced from your IDS/IPS vendor’s rule feed rather than improvised, since the precise packet structure that triggers the assertion failure is not reproduced in the data available here

Timeline

References

• ISC Knowledgebase Advisory AA-01272 (archived)
• Red Hat Errata RHSA-2015:1513
• Juniper Security Bulletin — Junos Vulnerability in ISC BIND named
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2015-5477