---
title: "CVE-2015-5477:  ISC BIND Data Processing Errors Vulnerability"
url: https://erroneo.us/security/cve/CVE-2015-5477/
description: "CVE-2015-5477 (ISC BIND): Exploited in the wild (CISA KEV). named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to…"
type: vulnerability-record
section: "Security Digest"
date_published: 2015-07-29
date_modified: 2026-10-09
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2015-5477"
kev: true
cvss: 7.5
epss: 0.99409
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2015-5477:  ISC BIND Data Processing Errors Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run ISC BIND. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2026-10-08, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2026-10-11 ; treat that as the outer limit, not the target.
- EPSS 99.4% , percentile 99.9: FIRST’s model estimates a 99.4% chance of exploitation activity in the next 30 days, higher than 99.9% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Editorial verdict: Check exposure. BIND CVE-2015-5477: 2015 TKEY DNS Crash Bug Now in KEV — Any BIND release from the past decade is fixed, so most teams have nothing to do; the real risk is forgotten DNS servers and appliances still running pre-mid-2015 BIND, which one packet can knock offline.

## What it is

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

## Affected products (CVE record)

- n/a n/a: see advisory

## Severity

- CISA-ADP CVSS 3.1: 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

## Exploitation

- CISA KEV: added 2026-10-08; federal due date 2026-10-11. Known ransomware use: Unknown.
- CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CISA SSVC assessment: exploitation active , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 99.41% probability of exploitation activity in the next 30 days; percentile 99.9.

## Sources

- [openSUSE-SU-2015:1326](http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.html)
- [RHSA-2015:1513](http://rhn.redhat.com/errata/RHSA-2015-1513.html)
- [SUSE-SU-2015:1305](http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.html)
- [FEDORA-2015-12316](http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163015.html)
- [HPSBUX03410](http://marc.info/?l=bugtraq&m=144017354030745&w=2)
- [SSRT102248](http://marc.info/?l=bugtraq&m=144294073801304&w=2)
- [RHSA-2016:0079](http://rhn.redhat.com/errata/RHSA-2016-0079.html)
- [RHSA-2015:1514](http://rhn.redhat.com/errata/RHSA-2015-1514.html)
- [USN-2693-1](http://www.ubuntu.com/usn/USN-2693-1)
- [SUSE-SU-2015:1316](http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00045.html)
- [openSUSE-SU-2015:1335](http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00001.html)
- [RHSA-2015:1515](http://rhn.redhat.com/errata/RHSA-2015-1515.html)
- [SUSE-SU-2015:1322](http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00048.html)
- [GLSA-201510-01](https://security.gentoo.org/glsa/201510-01)
- [SUSE-SU-2015:1304](http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00043.html)
- [HPSBOV03506](http://marc.info/?l=bugtraq&m=144181171013996&w=2)
- [DSA-3319](http://www.debian.org/security/2015/dsa-3319)
- [FEDORA-2015-12357](http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163007.html)
- [HPSBUX03400](http://marc.info/?l=bugtraq&m=144000632319155&w=2)
- [FEDORA-2015-12335](http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163006.html)
- [RHSA-2016:0078](http://rhn.redhat.com/errata/RHSA-2016-0078.html)
- [SUSE-SU-2016:0227](http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html)
- [Listed in CISA KEV notes (web.archive.org)](https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272)
- [Listed in CISA KEV notes (access.redhat.com)](https://access.redhat.com/errata/RHSA-2015:1513.html)
- [Listed in CISA KEV notes (supportportal.juniper.net)](https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477)
- [CVE.org record CVE-2015-5477](https://www.cve.org/CVERecord?id=CVE-2015-5477)
- [NVD entry CVE-2015-5477](https://nvd.nist.gov/vuln/detail/CVE-2015-5477)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5477)
- [Listed in CISA KEV notes (cisa.gov)](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [Listed in CISA KEV notes (cisa.gov)](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk)
- [packetstormsecurity.com](http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.html)
- [oracle.com](http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html)
- [h20564.www2.hpe.com](https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04789415)
- [kb.juniper.net](https://kb.juniper.net/JSA10783)
- [security.netapp.com](https://security.netapp.com/advisory/ntap-20160114-0001/)
- [kb.isc.org](https://kb.isc.org/article/AA-01438)
- [h20566.www2.hpe.com](https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05095918)
- [oracle.com](http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html)
- [kb.juniper.net](http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718)
- [support.apple.com](https://support.apple.com/kb/HT205032)
- [1033100](http://www.securitytracker.com/id/1033100)
- [kb.isc.org](https://kb.isc.org/article/AA-01307)
- [76092](http://www.securityfocus.com/bid/76092)
- [37721](https://www.exploit-db.com/exploits/37721/)
- [h20564.www2.hpe.com](https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480)
- [37723](https://www.exploit-db.com/exploits/37723/)
- [kb.isc.org](https://kb.isc.org/article/AA-01305)
- [kb.isc.org](https://kb.isc.org/article/AA-01306)
- [kc.mcafee.com](https://kc.mcafee.com/corporate/index?page=content&id=SB10126)
- [kb.isc.org](https://kb.isc.org/article/AA-01272)

---
Source page: https://erroneo.us/security/cve/CVE-2015-5477/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt