ISC BIND Denial of Service Vulnerability (CVE-2015-5477)

Catalog analysis: CISA added this entry on October 08, 2026. The entry reflects catalog information retrieved on October 08, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2015-5477 is a vulnerability involving data processing errors (CWE-19) within ISC BIND. The flaw allows a remote attacker to cause a denial of service (DoS) by sending specifically crafted TKEY queries to the affected system. This can lead to service instability or unavailability for DNS resolution.

Exposure and applicability

This vulnerability affects systems running ISC BIND that are configured to process TKEY queries. Because BIND is an open-source component, this exposure may extend beyond standalone installations to third-party libraries, proprietary implementations, and integrated products from various vendors.

Infrastructure owners should prioritize assets with direct internet exposure, as the attack vector is remote. The applicability of this vulnerability depends on whether the specific version of BIND in use contains the data processing error and if TKEY functionality is enabled or reachable.

Remediation priorities

Our analysis suggests that remediation should be prioritized based on the asset’s role in critical infrastructure and its level of exposure to untrusted networks.

1. Vendor Mitigation Application: The primary corrective action is to apply mitigations according to official vendor instructions. This may involve patching the BIND software or applying specific configuration changes provided by the vendor.
2. Exposure Assessment: Organizations should identify all instances of ISC BIND, including those embedded in third-party appliances or cloud services, to ensure no shadow infrastructure remains vulnerable.
3. Service Discontinuation: In scenarios where mitigations are unavailable for a legacy system and the risk is deemed unacceptable, discontinuing use of the product may be necessary to eliminate the exposure path.

How to validate remediation

Verifying that a vulnerability has been mitigated requires more than a version check. To ensure exposure is actually reduced, defenders should:

• Verify Mitigation Deployment: Confirm that the specific vendor-recommended patch or configuration change has been successfully applied across all identified assets.
• Functional Testing: In a controlled environment, verify that the system continues to perform required DNS functions while adhering to the new security constraints.
• Configuration Audit: Review the BIND configuration files to ensure that any compensating controls (such as restricting TKEY queries) are active and correctly scoped.

Limits and open questions

While applying vendor mitigations reduces the likelihood of a successful DoS attack via this specific vector, residual risk remains. Other data processing errors or different attack vectors targeting DNS services may exist.

It is currently unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, because BIND is widely integrated into other products, organizations must rely on the security advisories of their specific hardware or software vendors to determine if their proprietary implementations are affected and patched.

Source and editorial note

CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability · Source date: October 08, 2026 · Retrieved October 08, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment