CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability

The Hacker News describes CVE-2015-5477 as "a reachable assertion vulnerability in ISC BIND that could allow a remote attacker to cause a denial-of-service via TKEY queries"[1], with a CVSS score of 7.5.The vulnerability tracker cve-security.com reports that CISA listed this CVE in the KEV catalog on Oct. 8, 2026, with a federal remediation deadline of Oct. 11, 2026[2].Ubuntu's advisory says named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit)[3].According to Red Hat, the flaw can make named "exit unexpectedly with an assertion failure via a specially crafted DNS request packet"[4]. Red Hat also states that it "has received reports about ongoing exploitation of this vulnerability."[4]The Hacker News reports that the KEV additions coincide with a joint advisory released by Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S.[1]The outlet says these operations target eight security vulnerabilities, including the five listed above, to obtain initial access to organizations and siphon sensitive data[1].According to cve-security.com, Metasploit carries the auxiliary/dos/dns/bind_tkey module[2], Exploit-DB has entries for the flaw, and there are public proof-of-concept repositories.The Hacker News reports that federal agencies are required to apply the necessary patches or discontinue their use by October 11, 2026[1].