BIND's 2015 CVE-2015-5477 Added to CISA KEV Oct. 2026; Check named Now

I happened to see CISA add ISC BIND's CVE-2015-5477 to KEV on 8 Oct. 2026. When I read the year in the CVE ID, I thought it was a typo, but it was correct. This really is a bug from 2015, meaning that 11 years later, old DNS servers are still on the internet for attackers to target. I put this together for anyone who still has an old BIND installation to look after.

What happened

According to ISC's advisory (AA-01272), a specially crafted TKEY query packet triggers a REQUIRE assertion failure in BIND, causing named to terminate. The DNS server then stops responding. Anyone who can keep sending these packets can keep the service down. This is a DoS attack, not a server takeover.

One point to know is that ISC says both recursive and authoritative servers are affected, and ACLs and settings that restrict access cannot prevent it, because the vulnerable code runs before those checks. ISC also records that a third party published a proof of concept in a public code repository. The discoverer was Jonathan Foote.

Severity

• CVSS v2: 7.8 with vector AV:N/AC:L/Au:N/C:N/I:N/A:C. Both ISC and NVD give this score. ISC labels it Critical in its own advisory.
• CVSS v3.1: 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. NVD displays this as a secondary contributor's score, not NVD's own.
• CISA KEV: Added 8 Oct. 2026, with a remediation deadline of 11 Oct. 2026. CISA's assessment in this entry lists exploitation as active and automatable as yes. The required action displayed by NVD is to apply mitigations per vendor instructions, following CISA BOD 26-04, or discontinue use of the product if that is not possible.
• Ransomware: The KEV feed lists Unknown.

The impact is purely DoS. The advisories I read do not report code execution or data access, but for DNS that an entire organization's web and mail services depend on, a single named crash means nothing can resolve domain names.

Affected and fixed versions

ISC recommends upgrading to the fixed release closest to the version currently in use and states that there is no workaround. As for distro information, the CVE record's references include advisories from Debian (DSA-3319), Ubuntu (USN-2693-1), and Red Hat (RHSA-2015:1513, 1514, 1515). I have not read each of them. If you use a distro package, check its changelog with the commands below, because distros often backport patches without changing the version number.

How to check and fix it

Check the version of named that is actually running, not just the one installed.

named -v
# Debian / Ubuntu
dpkg -l bind9 | grep '^ii'
apt changelog bind9 2>/dev/null | grep -m1 CVE-2015-5477
# RHEL / Rocky / AlmaLinux
rpm -q bind
rpm -q --changelog bind | grep -m1 CVE-2015-5477

You can also query the version remotely, but many sites hide or override this value. No response does not mean it is safe.

dig +short chaos txt version.bind @ns1.example.com

If the version falls within an affected range, update and restart.

# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade bind9
sudo systemctl restart named     # บาง distro ใช้ชื่อ bind9

# RHEL ตระกูลเดียวกัน
sudo dnf upgrade bind
sudo systemctl restart named
named -v

1. Inventory every DNS server you know about, including devices with a built-in resolver.
2. Check the version with named -v and the package changelog.
3. Update or move to a newer branch if it is 9.8 or earlier.
4. Restart and recheck that the running version has actually changed.

Why old versions are still around

This is my own inference from what I have encountered, not information from the advisory. BIND is embedded in many types of devices, such as routers, firewall appliances, and DNS boxes whose manufacturers have stopped releasing firmware. On those models, you cannot update the package yourself, and administrators often do not know BIND is inside. Pay particular attention to DNS servers set up long ago that nobody dares touch, from internal resolvers and DNS for old domains to forgotten machines.

CISA states in the entry that if mitigation is not possible, discontinue use of the product. For a device with no new firmware available, that means replacing it.

Check whether you have been attacked

ISC and CISA have not published IOCs for this vulnerability in the sources I read, and I found no specific testing guidance from ISC in advisory AA-01272, so I will not describe how to test it with crafted packets. The signs to look for are named repeatedly terminating and assertion failure messages involving REQUIRE in the logs.

sudo journalctl -u named --since "30 days ago" | grep -iE 'assertion|REQUIRE|exiting'

If this happens repeatedly and the version falls within an affected range, treat it as an actual attack.

Personally, if named accepts queries from the entire internet and its version falls within an affected range, I would update immediately rather than wait for the normal maintenance cycle, because the PoC has been public since 2015 and the attack takes a single packet. An internal resolver cut off from the internet can wait until the next maintenance window, but it should still be updated.

P.S. If you find BIND 9.8 or earlier, do not just plan to install a patch. Those branches have no fixed release; you need to move to a newer branch.

Sources: ISC Security Advisory AA-01272 (https://kb.isc.org/docs/aa-01272), NVD CVE-2015-5477 (https://nvd.nist.gov/vuln/detail/CVE-2015-5477), CVE record (https://www.cve.org/CVERecord?id=CVE-2015-5477), CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Information current as of 5 Nov. 2026. If ISC or the distros publish more information, I will come back and update this.