Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2015-5477

87
FAUCET Score

CVE-2015-5477 is a critical denial-of-service vulnerability affecting ISC BIND 9.x versions before 9.9.7-P2 and 9.10.x before 9.10.2-P3, allowing remote attackers to crash the daemon via specially crafted TKEY queries. With a CVSS score of 7.8 and an EPSS score indicating high exploitability, this flaw is easily exploitable over the network with low attack complexity, leading to a complete loss of availability for affected DNS services. Exploit code, including Metasploit modules and ExploitDB proofs-of-concept, is publicly available, and there is evidence of active exploitation and significant community discussion, as highlighted by media coverage and Reddit posts.

Impacted Technologies

VendorProductVersion(s)CPE
<= 9.9.7CPE matchmatch criteria
cpe:2.3:a:isc:bind:*:p1:*:*:*:*:*:*
<= 9.10.2CPE matchmatch criteria
cpe:2.3:a:isc:bind:*:p2:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

7.8HIGH

AV:N/AC:L/Au:N/C:N/I:N/A:C

Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Exploitability Score
10.0
Impact Score
6.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
91.28%
Probability of exploitation in next 30 days
EPSS Percentile
99.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
Metasploit: BIND TKEY Query Denial of Service · Jul 28, 2015
ExploitDB: EDB-37723 · Aug 5, 2015
This CVE's current EPSS score of 0.9128 is in the 100th percentile among its peer group of 51,466 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: bind-32:9.9.4-18.ael7b_1.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: bind-30:9.3.6-25.P1.el5_11.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: bind97-32:9.7.0-21.P2.el5_11.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: bind-32:9.8.2-0.37.rc1.el6_7.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6.4 Advanced Update SupportFixed in: bind-32:9.8.2-0.17.rc1.el6_4.7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6.5 Advanced Update SupportFixed in: bind-32:9.8.2-0.23.rc1.el6_5.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6.6 Extended Update SupportFixed in: bind-32:9.8.2-0.30.rc1.el6_6.4
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 4Fixed in: bind

Vendor Advisories (1)

redhatCVE-2015-5477Important

bind: TKEY query handling flaw leading to denial of service

Jul 28, 2015

References

kb.juniper.net / InfoCenter/index
lists.fedoraproject.org / pipermail/package-announce/2015-August/163006.html
lists.fedoraproject.org / pipermail/package-announce/2015-August/163007.html
lists.fedoraproject.org / pipermail/package-announce/2015-August/163015.html
lists.opensuse.org / opensuse-security-announce/2015-07/msg00043.html
lists.opensuse.org / opensuse-security-announce/2015-07/msg00044.html
lists.opensuse.org / opensuse-security-announce/2015-07/msg00045.html
lists.opensuse.org / opensuse-security-announce/2015-07/msg00048.html
lists.opensuse.org / opensuse-security-announce/2015-07/msg00050.html
lists.opensuse.org / opensuse-security-announce/2015-08/msg00001.html
lists.opensuse.org / opensuse-security-announce/2016-01/msg00033.html
marc.info
marc.info
marc.info
marc.info
packetstormsecurity.com / files/132926/BIND-TKEY-Query-Denial-Of-Service.html
rhn.redhat.com / errata/RHSA-2015-1513.html
rhn.redhat.com / errata/RHSA-2015-1514.html
rhn.redhat.com / errata/RHSA-2015-1515.html
rhn.redhat.com / errata/RHSA-2016-0078.html
rhn.redhat.com / errata/RHSA-2016-0079.html
h20564.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay
h20564.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay
h20566.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay
kb.isc.org / article/AA-01272
PatchVendor Advisory
kb.isc.org / article/AA-01305
kb.isc.org / article/AA-01306
kb.isc.org / article/AA-01307
kb.isc.org / article/AA-01438
kb.juniper.net / JSA10783
kc.mcafee.com / corporate/index
security.gentoo.org / glsa/201510-01
security.netapp.com / advisory/ntap-20160114-0001
support.apple.com / kb/HT205032
exploit-db.com / exploits/37721
exploit-db.com / exploits/37723
debian.org / security/2015/dsa-3319
oracle.com / technetwork/topics/security/bulletinjul2015-2511963.html
oracle.com / technetwork/topics/security/ovmbulletinjul2016-3090546.html
securityfocus.com / bid/76092
securitytracker.com / id/1033100
ubuntu.com / usn/USN-2693-1