IT SBIT Services
Schneeberger
DEEN
CVE tracker

ISC BIND: Denial of service via TKEY queries

CVE-2015-5477High 7.5Actively exploitedPublic exploit

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 8 Oct 2026
Deadline for US federal agencies: 11 Oct 2026

Summary

ISC BIND 9 is the named DNS server software, used as authoritative and recursive DNS server. A remote attacker without authentication can send crafted TKEY queries that trigger a REQUIRE assertion failure and make named exit. DNS resolution then stops until the service is restarted. The flaw is actively exploited and public exploit code exists, and ACLs do not prevent exposure.

Affected

  • ISC BIND 9 from 9.1.0 (inclusive) through 9.9.7-P1
  • ISC BIND 9.10.x through 9.10.2-P2
  • Note: the CPE data lists Juniper Junos. The flaw is in ISC BIND, which Junos bundles. Junos versions affected: unknown.

Fixed in

  • ISC BIND 9.9.7-P2
  • ISC BIND 9.10.2-P3
  • Distribution patches: Red Hat RHSA-2015:1513, Debian DSA-3319
  • Junos fixed versions: unknown. Check the Juniper bulletin.

Workaround

  • No official workaround. ACLs and configuration options do not prevent exposure.
  • Unverified stopgap from a secondary source: restrict or disable TKEY queries until patching is possible.

Exploitation

  • Listed in the CISA Known Exploited Vulnerabilities catalog: added 2026-10-08, due 2026-10-11
  • Named in CISA advisory AA26-281A as a successfully exploited vulnerability
  • Public exploit code and a Metasploit DoS module are available
  • No authentication required; a single crafted query is enough

Our recommendation

  • Identify all BIND servers and check the named version.
  • Patch to a currently supported BIND release. The 9.9.7-P2 and 9.10.2-P3 fixes are only a minimum, as the 9.9 and 9.10 branches are reportedly end of life.
  • Restrict exposure of DNS port 53 and monitor named for unexpected exits.
  • Check Junos devices against the Juniper bulletin.
  • Treat any unpatched BIND 9.1.0 to 9.10.2-P2 instance as a priority.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:44.

Original description (NVD)

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD references (40)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed