Federal deadline looms for ISC BIND TKEY denial-of-service vulnerability
CISA has added CVE-2025-5477 to its catalog, mandating that federal agencies mitigate the high-severity flaw by October 11, 2026.
Key points
- CISA listed CVE-2025-5477 in the Known Exploited Vulnerabilities catalog on October 8, 2026.
- The vulnerability allows remote attackers to crash BIND servers via TKEY queries.
- Federal agencies must apply mitigations by October 11, 2026, or discontinue use of the product.
The Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies mitigate a high-severity denial-of-service vulnerability in ISC BIND by October 11, 2026. The agency added CVE-2025-5477 to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026, triggering a three-day window for compliance under Binding Operational Directive 26-04.
This directive requires stakeholders to apply vendor-recommended mitigations immediately. If mitigations are unavailable, agencies must discontinue the use of the affected product. The rule applies to cloud services as well, requiring adherence to specific patching guidelines based on risk evaluation.
How it unfolded
- October 8, 2026: CISA added CVE-2025-5477 to the KEV catalog, setting a federal due date of October 11, 2026.
- The vulnerability stems from data processing errors in ISC BIND that allow remote attackers to trigger a denial of service through TKEY queries.
- CISA’s entry notes that stakeholders must evaluate internet exposure for each asset and ensure compliance with BOD 26-04 guidance.
Who is affected
The vulnerability impacts ISC BIND versions 9.x prior to 9.9.7-P2 and 9.10.x prior to 9.10.2-P3. According to the National Vulnerability Database (NVD), the flaw has a CVSS score of 7.5, which is rated as HIGH.
The attack vector is remote, allowing attackers to cause a denial of service by sending specific TKEY queries. This results in a REQUIRE assertion failure and forces the daemon to exit, effectively crashing the DNS server. The NVD identifies the underlying weaknesses as CWE-19 (Information Exposure Through a Directory Listing) and CWE-617 (Synchronization Error in a Threaded Environment).
Our take on the response
CISA’s rapid addition of this 2015-era vulnerability to the KEV catalog underscores the ongoing risk of legacy infrastructure. While the CVE date suggests the flaw has existed for over a decade, its inclusion in the KEV catalog indicates that it is either currently being exploited in the wild or poses an imminent threat that warrants urgent federal action.
The short three-day deadline between the catalog addition and the mitigation due date places significant pressure on managed service providers and IT teams. Organizations must quickly audit their DNS infrastructure to identify any instances of affected BIND versions. Failure to comply with BOD 26-04 could result in non-compliance penalties for federal contractors and agencies.
Background: Attack vectors
Attack vectors are the paths adversaries use to reach your data. They range from simple phishing emails to complex supply chain compromises. Defending against them requires mapping every entry point, validating inputs, and limiting what each component can do. You cannot stop all attacks, but you can make them costly and slow.
Read the full guide: Attack Vectors Explained: Mechanisms, Limits, and Defense Strategies
What to do and how to stay safe: ISC BIND
- Audit your DNS infrastructure to identify any servers running ISC BIND versions 9.x before 9.9.7-P2 or 9.10.x before 9.10.2-P3.
- Review vendor documentation for available mitigations or patches for CVE-2025-5477 and apply them immediately.
- If no fix is available, consider disabling TKEY support or discontinuing the use of the affected product in exposed environments.
- Monitor network logs for unusual TKEY query patterns that may indicate exploitation attempts.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the deadline for fixing this vulnerability?
The federal due date for mitigation is October 11, 2026, as set by CISA.
Which versions of ISC BIND are affected?
Versions 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 are affected by CVE-2025-5477.
What is the severity of this vulnerability?
The NVD rates CVE-2025-5477 as HIGH with a CVSS score of 7.5.
