CVE-2015-5477 named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
HighCVSS 7.8
EPSS 99.6%
CISA KEV
added 2026-10-08 · due 2026-10-11
Exploited in the wild
Framework module
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CISA Known Exploited Vulnerability
- Date added
- 2026-10-08
- Due date (FCEB)
- 2026-10-11
- Ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bind9(Debian:12) | < 1:9.9.5.dfsg-11 | 1:9.9.5.dfsg-11 |
| debian/bind9(Debian:13) | < 1:9.9.5.dfsg-11 | 1:9.9.5.dfsg-11 |
| debian/bind9(Debian:14) | < 1:9.9.5.dfsg-11 | 1:9.9.5.dfsg-11 |
| juniper junos | < 12.1 | 12.1 |
| juniper junos | >= 13.1, < 13.2 | 13.2 |
| juniper junos | = 12.1 | No fix listed |
| juniper junos | = 12.1-r11 | No fix listed |
| juniper junos | = 12.1r | No fix listed |
| juniper junos | = 12.1x44 | No fix listed |
| juniper junos | = 12.1x44-d10 | No fix listed |
| juniper junos | = 12.1x44-d15 | No fix listed |
| juniper junos | = 12.1x44-d20 | No fix listed |
| juniper junos | = 12.1x44-d25 | No fix listed |
| juniper junos | = 12.1x44-d30 | No fix listed |
| juniper junos | = 12.1x44-d35 | No fix listed |
| juniper junos | = 12.1x44-d40 | No fix listed |
| juniper junos | = 12.1x44-d45 | No fix listed |
| juniper junos | = 12.1x44-d50 | No fix listed |
| juniper junos | = 12.1x45 | No fix listed |
| juniper junos | = 12.1x45-d10 | No fix listed |
| juniper junos | = 12.1x45-d15 | No fix listed |
| juniper junos | = 12.1x45-d20 | No fix listed |
| juniper junos | = 12.1x45-d30 | No fix listed |
| juniper junos | = 12.1x46 | No fix listed |
| juniper junos | = 12.1x46-d10 | No fix listed |
Show 130 more
| Product | Affected versions | Fixed in |
|---|---|---|
| juniper junos | = 12.1x46-d15 | No fix listed |
| juniper junos | = 12.1x46-d20 | No fix listed |
| juniper junos | = 12.1x46-d25 | No fix listed |
| juniper junos | = 12.1x46-d30 | No fix listed |
| juniper junos | = 12.1x46-d35 | No fix listed |
| juniper junos | = 12.1x47 | No fix listed |
| juniper junos | = 12.1x47-d10 | No fix listed |
| juniper junos | = 12.1x47-d15 | No fix listed |
| juniper junos | = 12.1x47-d20 | No fix listed |
| juniper junos | = 12.1x47-d25 | No fix listed |
| juniper junos | = 12.3 | No fix listed |
| juniper junos | = 12.3-r1 | No fix listed |
| juniper junos | = 12.3-r10 | No fix listed |
| juniper junos | = 12.3-r10-s1 | No fix listed |
| juniper junos | = 12.3-r10-s2 | No fix listed |
| juniper junos | = 12.3x48 | No fix listed |
| juniper junos | = 12.3x48-d10 | No fix listed |
| juniper junos | = 12.3x48-d15 | No fix listed |
| juniper junos | = 12.3x50 | No fix listed |
| juniper junos | = 12.3x50-d20 | No fix listed |
| juniper junos | = 12.3x50-d30 | No fix listed |
| juniper junos | = 12.3x50-d35 | No fix listed |
| juniper junos | = 12.3x50-d40 | No fix listed |
| juniper junos | = 12.3x50-d45 | No fix listed |
| juniper junos | = 13.2 | No fix listed |
| juniper junos | = 13.2-r1 | No fix listed |
| juniper junos | = 13.2-r2 | No fix listed |
| juniper junos | = 13.2-r3 | No fix listed |
| juniper junos | = 13.2-r4 | No fix listed |
| juniper junos | = 13.2-r5 | No fix listed |
| juniper junos | = 13.2-r6 | No fix listed |
| juniper junos | = 13.2-r7 | No fix listed |
| juniper junos | = 13.2-r7-s1 | No fix listed |
| juniper junos | = 13.2-r7-s2 | No fix listed |
| juniper junos | = 13.2-r8 | No fix listed |
| juniper junos | = 13.2x51 | No fix listed |
| juniper junos | = 13.2x51-d15 | No fix listed |
| juniper junos | = 13.2x51-d20 | No fix listed |
| juniper junos | = 13.2x51-d20.2 | No fix listed |
| juniper junos | = 13.2x51-d21 | No fix listed |
| juniper junos | = 13.2x51-d25 | No fix listed |
| juniper junos | = 13.2x51-d26 | No fix listed |
| juniper junos | = 13.2x51-d30 | No fix listed |
| juniper junos | = 13.2x51-d35 | No fix listed |
| juniper junos | = 14.1 | No fix listed |
| juniper junos | = 14.1-r1 | No fix listed |
| juniper junos | = 14.1-r2 | No fix listed |
| juniper junos | = 14.1-r3 | No fix listed |
| juniper junos | = 14.1-r4 | No fix listed |
| juniper junos | = 14.1-r5 | No fix listed |
| juniper junos | = 14.1x50 | No fix listed |
| juniper junos | = 14.1x50-d60 | No fix listed |
| juniper junos | = 14.1x51 | No fix listed |
| juniper junos | = 14.1x51-d60 | No fix listed |
| juniper junos | = 14.1x53 | No fix listed |
| juniper junos | = 14.1x53-d10 | No fix listed |
| juniper junos | = 14.1x53-d15 | No fix listed |
| juniper junos | = 14.1x53-d16 | No fix listed |
| juniper junos | = 14.1x53-d20 | No fix listed |
| juniper junos | = 14.1x53-d25 | No fix listed |
| juniper junos | = 14.1x53-d26 | No fix listed |
| juniper junos | = 14.1x53-d27 | No fix listed |
| juniper junos | = 14.1x53-r1 | No fix listed |
| juniper junos | = 14.2 | No fix listed |
| juniper junos | = 14.2-r | No fix listed |
| juniper junos | = 14.2-r1 | No fix listed |
| juniper junos | = 14.2-r2 | No fix listed |
| juniper junos | = 14.2-r3 | No fix listed |
| juniper junos | = 14.2-r4 | No fix listed |
| juniper junos | = 15.1 | No fix listed |
| juniper junos | = 15.1-a1 | No fix listed |
| juniper junos | = 15.1-f | No fix listed |
| juniper junos | = 15.1-f1 | No fix listed |
| juniper junos | = 15.1-f2 | No fix listed |
| juniper junos | = 15.1-f2-s1 | No fix listed |
| juniper junos | = 15.1-f2-s2 | No fix listed |
| juniper junos | = 15.1-f2-s3 | No fix listed |
| juniper junos | = 15.1-f2-s4 | No fix listed |
| juniper junos | = 15.1-r | No fix listed |
| juniper junos | = 15.1-r1 | No fix listed |
| juniper junos | = 15.1x49 | No fix listed |
| juniper junos | = 15.1x49-d10 | No fix listed |
| juniper junos | = 15.1x49-d15 | No fix listed |
| juniper junos | = 15.1x49-d20 | No fix listed |
| juniper junos | = 15.1x49-d25 | No fix listed |
| juniper junos | = 15.1x53 | No fix listed |
| juniper junos | = 15.1x53-d10 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| redhat enterprise linux | = 5.0 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux aus | = 6.4 | No fix listed |
| redhat enterprise linux aus | = 6.5 | No fix listed |
| redhat enterprise linux aus | = 6.6 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| oracle vm server | = 3.2 | No fix listed |
| oracle solaris | = 10 | No fix listed |
| oracle solaris | = 11.2 | No fix listed |
| HP Inc hp-ux | = 11.11 | No fix listed |
| HP Inc hp-ux | = 11.23 | No fix listed |
| HP Inc hp-ux | = 11.31 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| netapp clustered data ontap | All versions | No fix listed |
| apple os x server | = 4.1.5 | No fix listed |
| hpe dns | = 9.2.3 | No fix listed |
| hpe dns | = 9.3 | No fix listed |
| HP Inc openvms | = 5.7 | No fix listed |
| hpe vcx | < 9.8.18 | 9.8.18 |
| SUSE linux enterprise debuginfo | = 11-sp3 | No fix listed |
| SUSE linux enterprise debuginfo | = 11-sp4 | No fix listed |
| openSUSE evergreen | = 11.4 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp3 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp4 | No fix listed |
| SUSE linux enterprise desktop | = 12 | No fix listed |
| SUSE linux enterprise server | = 10-sp4 | No fix listed |
| SUSE linux enterprise server | = 11-sp1 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp4 | No fix listed |
| SUSE linux enterprise server | = 12 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp3 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp4 | No fix listed |
| SUSE linux enterprise software development kit | = 12 | No fix listed |
| isc bind | >= 9.1.0, < 9.9.7 | 9.9.7 |
| isc bind | >= 9.10.0, < 9.10.2 | 9.10.2 |
| isc bind | = 9.10.2-p1 | No fix listed |
References
- Debian Security Tracker CVE-2015-5477 vendor-advisory
- bugs.debian.org issue-tracking
- packetstormsecurity.com third-party-advisory vdb-entry
- www.oracle.com third-party-advisory
- openSUSE-SU-2015:1326 mailing-list third-party-advisory vendor-advisory
- h20564.www2.hpe.com third-party-advisory
- kb.juniper.net third-party-advisory
- RHSA-2015:1513 third-party-advisory vendor-advisory
- SUSE-SU-2015:1305 mailing-list third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- kb.isc.org broken-link
- FEDORA-2015-12316 mailing-list third-party-advisory vendor-advisory
- HPSBUX03410 mailing-list third-party-advisory vendor-advisory
- SSRT102248 mailing-list third-party-advisory vendor-advisory
- RHSA-2016:0079 third-party-advisory vendor-advisory
- h20566.www2.hpe.com third-party-advisory
- www.oracle.com third-party-advisory
- kb.juniper.net mitigation third-party-advisory
- RHSA-2015:1514 third-party-advisory vendor-advisory
- USN-2693-1 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- 1033100 broken-link vdb-entry
- kb.isc.org broken-link
- 76092 third-party-advisory vdb-entry
- SUSE-SU-2015:1316 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2015:1335 mailing-list third-party-advisory vendor-advisory
- 37721 exploit third-party-advisory vdb-entry
- RHSA-2015:1515 third-party-advisory vendor-advisory
- SUSE-SU-2015:1322 mailing-list third-party-advisory vendor-advisory
- GLSA-201510-01 third-party-advisory vendor-advisory
- SUSE-SU-2015:1304 mailing-list third-party-advisory vendor-advisory
- HPSBOV03506 mailing-list third-party-advisory vendor-advisory
- h20564.www2.hpe.com third-party-advisory
- DSA-3319 mailing-list third-party-advisory vendor-advisory
- FEDORA-2015-12357 mailing-list third-party-advisory vendor-advisory
- HPSBUX03400 mailing-list third-party-advisory vendor-advisory
- FEDORA-2015-12335 mailing-list third-party-advisory vendor-advisory
- 37723 exploit third-party-advisory vdb-entry
- kb.isc.org broken-link
- RHSA-2016:0078 third-party-advisory vendor-advisory
- SUSE-SU-2016:0227 mailing-list third-party-advisory vendor-advisory
- kb.isc.org broken-link
- kc.mcafee.com broken-link
- kb.isc.org broken-link patch vendor-advisory
- www.cisa.gov government-resource us-government-resource