CVE-2015-5477

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2015-5477

ISC · BIND · Added 2026-10-08 · Published 2015-07-29

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

Vulnerability ISC BIND Data Processing Errors Vulnerability

VendorISC

ProductBIND

Date added2026-10-08

Due date2026-10-11

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-19 CWE-617

Descriptions

KEV: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

NVD: named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impactpartial

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-10-08 20:03 UTC

Wall time0.8s

Searches2

Component defaultyes

Sources https://kb.isc.org/docs/aa-01272
https://github.com/isc-projects/bind9/commit/dbb064aa7972ef918d9a235b713108a4846cbb62
https://github.com/robertdavidgraham/cve-2015-5477
https://github.com/elceef/tkeypoc
https://github.com/tintinweb/pub/tree/master/pocs/cve-2015-5477
https://github.com/xycloops123/TKEY-remote-DoS-vulnerability-exploit
https://github.com/ilanyu/cve-2015-5477
https://www.exploit-db.com/exploits/37721/
https://www.exploit-db.com/exploits/37723/
https://nvd.nist.gov/vuln/detail/CVE-2015-5477

QC notes

warn component_extraction: Component 'dns_tkey_processquery() in BIND lib/dns/tkey.c (TKEY query processing)' matches or contains product name 'BIND' — no specific component identified

Hunting hypothesis agent

Hunt DNS query logs and packet captures for QTYPE TKEY (249) queries on port 53 carrying a same-named non-TKEY record (TXT/WKS) in the additional section, the pattern that trips dns_tkey_processquery's REQUIRE assertion and kills named.

Research details

Componentdns_tkey_processquery() in BIND lib/dns/tkey.c (TKEY query processing)

PreconditionsNo authentication required; attacker only needs network reachability to the DNS service on UDP/TCP 53. Affects BIND 9.1.0 through 9.9.7-P1 and 9.10.0 through 9.10.2-P2 (fixed in 9.9.7-P2 / 9.10.2-P3); ACLs and allow-query restrictions do not block it because the TKEY lookup runs before those checks, and no configuration workaround exists. agent

DeliverySingle crafted DNS query (QTYPE TKEY) to port 53 over UDP or TCP

Public PoCyes

PoC URLs https://github.com/robertdavidgraham/cve-2015-5477
https://github.com/elceef/tkeypoc
https://github.com/tintinweb/pub/tree/master/pocs/cve-2015-5477
https://github.com/xycloops123/TKEY-remote-DoS-vulnerability-exploit
https://github.com/ilanyu/cve-2015-5477
https://www.exploit-db.com/exploits/37721/
https://www.exploit-db.com/exploits/37723/ Third-party repos; verify before use.

Advisoryhttps://kb.isc.org/docs/aa-01272

Exploit notesSingle-packet denial of service: each public PoC (C, Python, PHP) sends one DNS query with QTYPE TKEY (249) and a same-named non-TKEY record in the additional section over UDP or TCP 53; no authentication, user interaction, or special configuration. The defect is an unreset name pointer in dns_tkey_processquery that trips a REQUIRE assertion and terminates named (patch resets name = NULL before the answer-section lookup).

SummaryISC BIND's TKEY query handler (dns_tkey_processquery in lib/dns/tkey.c) fails to reset a name pointer between additional- and answer-section lookups, so a single crafted DNS query with QTYPE TKEY plus a same-named non-TKEY record in the additional section triggers a REQUIRE assertion failure and terminates named. Both authoritative and recursive servers running BIND 9.1.0-9.9.7-P1 and 9.10.0-9.10.2-P2 are affected, ACLs do not help, and no configuration workaround exists. Multiple public single-packet PoCs are available; fixed in 9.9.7-P2 and 9.10.2-P3.

Tia coverage

First reported2026-10-08

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-five-exploited-vulnerabilities-to-kev-catalog

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.