Zero Radar
← feed
CriticalVulnerabilityCVE-2015-5477updated 25 Oct 2026, 17:35 UTC

BIND DNS server can be crashed by a crafted TKEY query

A specially crafted network request can make the BIND DNS server stop running. When it crashes, computers relying on it may lose name lookups and websites or services may stop working.

Exploited (CISA KEV)Official, 2 sources
SeverityCriticalCVSS 7.5 of 10
Being exploited?YesConfirmed by CISA KEV · 8 Oct 2026,
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends crafted TKEY query
  2. 2InternetQuery reaches DNS server
  3. 3BIND serverREQUIRE assertion fails
  4. 4named exitsDaemon stops running
  5. ResultDNS service goes offline

What happened

ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 fail a REQUIRE assertion when processing TKEY queries, causing the named daemon to exit. This is a denial-of-service flaw.

Why it is dangerous: Remote attackers can take down DNS service without authentication, disrupting name resolution for every client that depends on the affected server.

Are you affected?

You are affected if you run ISC BIND 9.9.x before 9.9.7-P2 or 9.10.x before 9.10.2-P3 and that server accepts queries from untrusted networks.

ISC BIND 9.x before 9.9.7-P2; ISC BIND 9.10.x before 9.10.2-P3

What to do

  1. Check your BIND version with 'named -v' and confirm whether it is in an affected range.
  2. Upgrade BIND to a version that includes the fix, following the ISC and vendor instructions.
  3. If you cannot upgrade immediately, restrict which networks can send queries to the DNS server and follow CISA BOD 26-04 guidance.
  4. Monitor the DNS server for unexpected crashes or restarts.

Timeline

  1. 17 May 2022, 00:25 UTC
    Publicly disclosed
  2. 8 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2015-5477 · GHSA-4622-vjcx-p39j
CVSS
7.5 / 10
EPSS
100% chance of exploitation within 30 days
Disclosed
17 May 2022, 00:25 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

BIND DNS server can be crashed by a crafted TKEY query · Zero Radar