CVE-2015-5477: ISC BIND TKEY Query Assertion Failure Denial of Service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote crash of a core DNS service with very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 mishandle TKEY queries, triggering a REQUIRE assertion failure that terminates the named daemon. Because a single malformed query can take down a DNS server, this is a serious availability risk for any organization running an unpatched resolver or authoritative server.

Impact

A remote attacker can crash the named process, causing a denial of service for all DNS resolution or authoritative service handled by that instance. There is no confidentiality or integrity impact; only availability is affected.

Attack surface

The flaw is reachable over the network via a crafted TKEY query sent to the DNS service, as reflected by the AV:N/AC:L/Au:N vector. No authentication or user interaction is required, and the attacker only needs network reachability to the DNS port.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit tags, but EPSS is very high at 0.91284 (99.8th percentile), indicating strong predicted exploitation activity. No ransomware group usage is documented.

What to do

• Upgrade to BIND 9.9.7-P2, 9.10.2-P3, or a later supported release immediately.
• If immediate patching is not possible, restrict DNS service exposure to trusted networks and disable or filter TKEY queries where feasible.
• Apply vendor errata for packaged BIND distributions (Red Hat, Debian, openSUSE, Oracle, Juniper) rather than building from source.
• Monitor BIND vendor advisories and re-check for updated patches, since the record is marked Modified.

Detection

• Alert on named process exits or restarts correlated with REQUIRE assertion failure messages in BIND logs.
• Inspect DNS query logs for TKEY query types (QTYPE 249) from unexpected or external sources.
• Use network monitoring to flag anomalous volumes of TKEY queries directed at DNS servers.
• Track DNS service availability drops that coincide with inbound TKEY traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.