CVE-2015-5477 Exploited in the wild

ISC BIND Data Processing Errors Vulnerability

Risk score: 100/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 99.4%
Published: 29 Jul 2015
Added to CISA's exploited list: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
Affected: Isc Bind before 9.9.7, 9.10.2
Fix: Upgrade Isc Bind to 9.9.7 or 9.10.2 (whichever matches your release line), or later.
Exploitation: Exploited in the wild

Why it is Red

CVSS 7.5 high
Exploitation likely: EPSS 99.4% (top 1%)
Exploited in the wild (CISA KEV)
Remotely exploitable without logging in

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

Original description

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Last activity 8 Oct 2026. Patch Forecast updates every hour.