CVE-2015-5477: ISC BIND TKEY query REQUIRE assertion failure (remote named crash)
Exploited in the wild High 7.5 EPSS 99.6% ISC BIND 9
A single crafted DNS query for a TKEY record makes BIND's named hit a REQUIRE assertion and exit, a remote unauthenticated denial of service against both recursive and authoritative servers. ACLs and configuration options do not prevent it because the faulty code runs before those checks, and ISC lists no workarounds. It was fixed in July 2015 (BIND 9.9.7-P2 and 9.10.2-P3); CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-08, so any still-unpatched legacy BIND servers should be upgraded.
- CVE-2015-5477CVE identifier
- 7.5CVSS 3.1 base score (high)
- 2026-10-08added to CISA's exploited list (US federal deadline 2026-10-11)
- 99.6%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
- 2015-07-29published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run ISC BIND 9 and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Restart named after updating.
- If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
- Because this flaw is being exploited, also check the server for signs of compromise.
Affected and fixed versions
Affected:
- BIND 9.1.0 through 9.8.x
- BIND 9.9.0 through 9.9.7-P1
- BIND 9.10.0 through 9.10.2-P2
Fixed in:
- BIND 9.9.7-P2
- BIND 9.10.2-P3
Am I affected?
named -v
dpkg -l bind9 | grep ^ii
rpm -q bindPatch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade bind9
sudo systemctl restart namedUbuntu
sudo apt update
sudo apt install --only-upgrade bind9
sudo systemctl restart namedRHEL, AlmaLinux, Rocky, Oracle
sudo yum update bind
sudo systemctl restart namedFedora
sudo dnf upgrade --refresh bind bind-libsSUSE / openSUSE
sudo zypper refresh
sudo zypper update bindAmazon Linux
sudo dnf upgrade --releasever=latest bind bind-libsArch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade bind bind-libsFreeBSD
pkg update && pkg upgrade bind920Built from source
# Any currently supported BIND 9 release from https://www.isc.org/download/ contains the fix (first fixed: 9.9.7-P2, 9.10.2-P3)General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | bind9 | fixed | 1:9.9.5.dfsg-11 |
| Debian 13 | bind9 | fixed | 1:9.9.5.dfsg-11 |
| Debian testing | bind9 | fixed | 1:9.9.5.dfsg-11 |
| Red Hat Enterprise Linux 7 | bind-32:9.9.4-18.ael7b_1.3 | fixed | RHSA-2015:1513 |
| Red Hat Enterprise Linux 6 | bind-32:9.8.2-0.37.rc1.el6_7.2 | fixed | RHSA-2015:1513 |
| Red Hat Enterprise Linux 5 | bind-30:9.3.6-25.P1.el5_11.3 | fixed | RHSA-2015:1514 |
| Red Hat Enterprise Linux 5 | bind97-32:9.7.0-21.P2.el5_11.2 | fixed | RHSA-2015:1515 |
| Red Hat Enterprise Linux 4 | bind | out of support scope | |
| Debian 8 (jessie) | bind9 | fixed | 1:9.9.5.dfsg-9+deb8u2 (DSA-3319-1) |
| Debian 7 (wheezy) | bind9 | fixed | 1:9.8.4.dfsg.P1-6+nmu2+deb7u6 (DSA-3319-1) |
| Debian 12 / 13 | bind9 | fixed | not affected (current packages 9.18 / 9.20 are fixed) |
| RHEL 7 | bind | fixed | 9.9.4-18.ael7b_1.3 (RHSA-2015:1513) |
| RHEL 6 | bind | fixed | 9.8.2-0.37.rc1.el6_7.2 (RHSA-2015:1513) |
| RHEL 5 | bind | fixed | 9.3.6-25.P1.el5_11.3 (RHSA-2015:1514) |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
If you cannot patch yet
- None: ISC states there are no workarounds; ACLs and allow-query settings do not block it.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272 ; https://access.redhat.com/errata/RHSA-2015:1513.html; https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https:/
Sources
- ISC KB AA-01272: CVE-2015-5477 TKEY REQUIRE assertion failure
- Debian security tracker CVE-2015-5477
- Red Hat CVE-2015-5477 data
- CVE record CVE-2015-5477
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04789415
- https://kb.juniper.net/JSA10783
- https://security.netapp.com/advisory/ntap-20160114-0001/
- https://kb.isc.org/article/AA-01438
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05095918
- https://support.apple.com/kb/HT205032
- https://kb.isc.org/article/AA-01307
- https://www.exploit-db.com/exploits/37721/
- https://security.gentoo.org/glsa/201510-01
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480
- https://www.exploit-db.com/exploits/37723/
- https://kb.isc.org/article/AA-01305
- CVE-2015-5477 on CVE.org
- CVE-2015-5477 on NVD
- CISA Known Exploited Vulnerabilities catalog
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.